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1. SUMMARY 


The Real-Time Failure Control program Involves development of a failure 
detection algorithm, referred to as ’System for Failure and Anomaly 
Detection (SAFD) for the Space Shutle Haln Engine (SSHE). This failure 
detection approach Is signal-based and It entails monitoring SSHE 
measurement signals based on predetermined and computed mean values and 
standard deviations. Twenty-four engine measurements are Included In the 
algorithm and provisions are made to add more parameters If needed. Each of 
the (first) values of every measurement signal at the algorithm start Is 
checked against safety limits determined by a precomputed mean value (HV)+/- 
and a given multiple of a precomputed standard deviation (SO). If several 
parameters exceed these limits a failure Is signalled. Ourlng the first two 
seconds (after algorithm start) a moving average (HA) and a SO Is computed 
on-line, by averaging the values of each parameter In a 200 ms duration, and 
Is updated at every time Interval. The moving average Is checked against a 
similar safety band around the precomputed HV for each parameter and if 

W's several anomalies are registered a failure Is signalled by the algorithm. 

At the end of the two-second Interval the HA Is fixed as the mean value for 
the rest of the algorithm operation and a safety band Is placed above and 
, below this value equal to a multiple of the computed SO. The HA Is 
continuously updated and checked against this safety band. Once more if 
several parameters exceed the limits a failure Is signalled. At the start 
of every scheduled power transient the algorithm Is stopped. It Is 
re-lnitlated after two seconds from the termination of the power transient 

and the process Is repeated. 

This final report Is divided Into six major sections. The most encompassing 
of all Is the discussion section that has sub-sections on: 1) SAFD 

algorithm development. 2) SAFD simulations. 3) OTH failure simulations. 4) 
closed-loop simulation. S) SAFD current limitations, and 6) enhancements 
planned for. The report will cover background Information, new 

developments, and future plans for the algorithm Implementation and 

enhancements. 

v- , 
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5. INTRODUCTION 


Anomalous behavior during Space Shuttle Main Engine (SSME) hot-fire testing 
Is presently detected via measurement redllnes that are Implemented on key 
measured parameters. In order to avoid the cost Incurred and the Impact on 
the SSME flight schedule due to failures, it Is very desirable to have an 
advanced failure detection system that can minimize damage and that can 
detect as many failures as possible, quickly and efficiently, prior to 
catastrophes. The safe operation of any complex system, such as the SSME, 
rests on the reliability of the control and fault detection systems and the 
speed of detection and Identification of component, sensor, or actuator 
failures. In the recent past, fault detection and Isolation has raised the 
Interest of many researchers [1-7]. Most major techniques to failure 
detection can be categorized as either model-based or signal-based 

approaches. 

Model-based techniques rely on analytical redundancy [4-8], Analytically 
generated "measurement" outputs are compared with hardware measurements by 
using present and/or previous values of some variables In conjunction with 
their mathematical relationships. The fault detection process herein 
encompasses three major tasks: 1) residual generation that entails taking 

the difference between the analytical and measured values, 2) statistical 
testing and signature generation, and 3) diagnostics and decision making. 

On the other hand, signal-based techniques are hardware intensive and 
sensor/actuator driven. In this approach, the major undertakings Include: 
1) limit/trend checking by comparison of plant outputs with normal 
operational limits, 2) sensor/actuator/component redundancy, whereby a 
single value from measurements of several Identical sensors Is used 
according to some decision mechanism, 3) frequency spectrum analyses by 
using plant measurements, wherein frequency spectrums are compared with 

normal spectrums [9-12]. 

An algorithm Is heraby developed, referrad to as 'System for Anomaly and 
Failure Detection (SAFD) , ' that permits fault detection during SSME hot fire 
testing by a simple signal-based approach. 
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The method entails monitoring the signal averages for 24 SAFD parameters and 
comparing the signal averages to upper and lower signal safety limits. The 
reason for monitoring the averages of signals, rather than their actual 
values, Is to smooth or filter out most of the undesirable effects of sensor 
noise. Moreover, the safety limits are placed above and below the fixed 
average value for each parameter with a bandwidth of n*SD, where n is a 
p re-determined constant that is large enough to avoid false alarms and small 
enough to make the algorithm sensitive to actual failures. 

The SAFD algorithm, as it is currently configured, works during SSME 
steady-state operation, starting at five seconds after engine start or two 
seconds after the completion of each scheduled power transient. Moreover, 
an added safety feature Is Included that checks the value of each SAFD 
parameter at the first Incoming measurement against pre-determlned expected 
values. In case several parameters exceed or are below their expected 
values, by more than a pre-determlned margin, then a failure Is signalled. 
This feature will ensure the normal engine operation by Identifying any 
failure that could have happened during start/power transients. Also, if 
any sensor Indicates a negative output, It Is automatically disqualified and 
eliminated from the algorithm. However, there Is no means of sensor failure 
detection In the present SAFD set-up. 

As described in the final reports of Phase I and II of the SAFD algorithm 
development contract [13], the original algorithm entailed failure detection 
based on three approaches. The first approach encompassed the first 
two-second Interval after algorithm start and It used precomputed mean value 
(MV) and standard deviation (SD) for each of the 23 parameters monitored. 
The moving average (MA) was checked against safety limits, placed above and 
below the fixed MV, equal to n^SD. The MA was computed continuously from 
the start of the algorithm until the end of the two-second Interval and 
updated at every sampling Instant of 80 milliseconds (thus, at the end of 
the two-second Interval the MA was the average of 2 sec. worth of 25 data 
points). If several parameters indicated exceedence of the safety limits 
(due to the MA exceedence (Approach 1)). then a failure was flagged out. At 
the end of the two-second Interval, the MA value was fixed and used as the 
MV for the rest of the algorithm operation. In approach 2, the continuously 
updated MA was compared to the safety limits, placed around this MV, equal 



to n *SD. In Approach 3, the actual signal was compared to the safety 
limits placed around the continuously updated MA and equal to a bandwidth of 
n *S0. Five SSME incident tests were simulated during Phase I and II [13] 
and the algorithm performed well as compared to the engine redlines. 

During the course of the present contract, the SAFD algorithm was refined 
and modified In several areas. Namely, the safety feature for anomaly check 
at the start of the algorithm, that was mentioned In the summary section 
was added and the MA was reduced from a two-second average to a 200 
millisecond moving average. The reason for this action was to make the MA 
more sensitive to sudden changes. The on-line check for anomaly that used 
the actual signal values for failure detection (Approach 2, utilized in the 
original SAFD algorithm) was eliminated, since the instrumentation noise 
level (excursions) could trigger false alarms. The use of a MA computed as 
the average of only the most recent five signal measurement values, as 
opposed to twenty-five. Is more sensitive to sudden failures and the 
averaging process removes most of the undesirable signal noise, thus 
avoiding false alarms without having to artifically Increase the safety 
bandwidth. Some of the originally monitored engine parameters are not 

currently in use (the sensors have been eliminated). Thus, the list of 

measurements monitored by SAFD were updated and a new set of 24 parameters 
were Included. Most of the engine redlines are In this list. Moreover, the 
sampling interval was reduced to 40 msec, with an option of reducing it to 
20 msec. If hardware capabilities permit. 

Eight SAFD algorithm simulations on actual data from SSME Incident tests 
were carried out during the current phase of the Real-Time Failure Control 
contract. Three real Incident tests and two hypothetical failures were 

simulated by the SSME Digital Transient Model (DTM). Moreover, over 40 

incident tests were carefully studied for useful information. Currently, 
the SAFD algorithm can handle only steady-state operating conditions. 
However, the start anomaly check Is really a post transient failure 

detection approach that will detect any anomalous developments that happen 

during start or power transient. There are some other perturbations, due 
either to transients like fuel or liquid oxygen (LOX) venting and 
repressurization effects or to fuel or gasseous oxygen (G0X) valve closure 
effects, that makes the present SAFD approach a little sluggish, in that the 
safety bandwidth has to be large enough to cover such excursions. Moreover, 


- 7 - 



there are nonlinear effects that appear In the behavior of some parameters 
(such as the HPOT pump discharge temperature that takes over 60 seconds to 
reach steady-state and has an excursion of over 50*F) for which special 
provisions need to be made to avoid false alarms. In addition, the SAFO 
performance Is a function of the multiplying factor n, and that of the 
number of required parameters that show anomalous behavior for an engine 
shutdown decision. 

Nevertheless, SAFD, as It is presently configured. Is very effective (much 
better than redlines) In detecting slow developing failures and it is 
slightly better than the redlines In fast failures, such as structural 
ruptures. Several of the SAFD advantages Include: 1) the requirement of a 

multiple parameter anomaly for a failure decision (this avoids false 
alarms), 2) the option of choosing a different bandwidth for different 
parameters and even for different intervals, 3) the use of a moving average 
that removes noise effects and is sufficiently short-term to enhance its 
sensitivity and use of the SD and the average values, and 4) the flexibility 
of the algorithm for further expansions and enhancements, among others. 

There are means of modifying the algorithm that will make it more 
encompassing and that will be discussed In what follows. An automated 
selection of the optimal safety bandwidth and the number of anomalous 
parameters required for a sure failure can be developed. Most of the 
shortcomings of the SAFD algorithm can thus be eliminated and plans for 
accomplishing this will be discussed later. 

This report covers: 1) background Information on past SSME failures and 

problems involving their detection, 2) detailed descriptions and simulation 
plots of the SAFD algorithm, 3) detailed descriptions of the DTM failure 
simulations, 4) the closed-loop simulation (DTM failure simulations with the 
SAFO In the loop), 5) limitations and advantages of the algorithm, and 6) 
plans for future work for the enhancement of SAFD. 

The objective of the present contract Is to develop a failure detection 
algorithm that will enhance and refine the -failure control techniques for 
the SSME- and demonstrate the operability of the SAFD algorithm in a 
closed-loop manner via engine simulations. The Rocketdyne Digital Transient 
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Model (DTM) 
algorithm 1 
behavior of 


was used to accomplish the goal. It will be shown that the SAFD 
s capable of detecting performance degradation and anomalous 
the SSME earlier and faster than the existing redllne system. 


- 9 - 



6. DISCUSSION 


Fault detection system design Involves several complex Issues, such as quick 
response prior to significant performance degradation or damage as well as 
consideration of system redundancy. Advanced fault detection algorithms, 
based on careful consideration of system dynamic characteristics, can often 
lead to significant reduction of hardware redundancy. There are three main 
concerns In any fault detection and Identification process. The primary 
objective Invariably is to establish that a failure has occurred with a high 
degree of certainty. The type and location of failure as well as the extent 
of degradation are two of the remaining concerns that should be addressed 
appropriately. The principal thrust of the present algorithm Involves the 
fault detection problem. 

6.1 BACKGROUND 

There were four major tasks Identified In the statement of work of the 
present contract. The first task Involved algorithm refinement, the 
second task was on provisions for avoidance of premature cutoff, the 
third task entailed simulation with the SAFD algorithm using real 
Incident test data, and the fourth task was related to the closed-loop 
simulation of DTM on-line with the SAFD algorithm. The Initial phase of 
the contract was directed towards the study and evaluation of all SSME 
Incident tests. Identification of areas of refinement In the algorithm, 
analyses of the characteristic behavior of key engine parameters and the 
availability of sensors and measurements that can easily be utilized for 
the algorithm Implementation. 
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6.1.1 INCIDENTS 


The occurrence of an anomaly or a failure Is classified as a "major" or 
a "minor" incident based on: a) the extent of damage, b) pressure, 
temperature, speed and vibration levels in excess of normal end item 
operating levels, and c) internal and/or external fires or explosions 
[13]. 

SAFD Parameter Selection Criteria [14]. 

The compilation in Table 6.1.1 is the list of all major failures or 
incidents of the SSME from 1977 to the present. The Table summarizes data 
on 40 failures that include: 1) test number, 2) the engine number on which 
failure occurred, 3) the date of anomaly, 4) duration from the start in 
seconds, 5) engine power level at the time of failure, 6) brief description 
of failure, 7) classification of failure as major or critical, 8) the 
location or unit that experienced the failure, 9) the redllne parameter that 
caused engine cutoff initiation, and 10) parameters, other than the redllne 
parameter, that showed significant change due to the failure. 

Forty (40) past incident tests were reviewed, excluding tests where: 

anomaly occurred after engine cutoff or during transient 
where no striking changes were indicated. 

A total of 40 tests were used to select the 24 parameters for the SAFD 
algorithm. Those measurement parameters were chosen that represented "key" 
aspects of SSME operation. Fifty-seven (57) measurements were examined 
for: a) anomaly induced percentage change from steady-state operation, b) 
rate of percentage change, c) interim from first Indications of an anomaly 
to cut off. Each of the above factors were weighed and accordingly, the 
most appropriate parameters were selected for use in the algorithm. 

A database was developed whereby all the generic and specific 
characteristics of various Incident tests were listed. This data was used 
to evaluate the significant parameters for failure detection use. 



Also Included In the evaluations were failure mode qualitative 
characteristics where generic descriptions of the Incident type and a sample 
of indicative parameters were studied. Shown are examples of indicative 
parameters where an anomaly Induces change from the steady-state value. 
These are sumnarlzed In Section 6.1. 1.1 as failure Investigations Including 
Incident and damage descriptions. 

A summary of data Is also presented that Includes: 1) sensor measurement 
standard deviations, 2) test-to-test envelope database definition, 3) data 
for time-sliced value deviations from the average steady-state sensor 
measurements, and 4) 31 database inputs for each test (see Table 6.1.2). 

Generated was data on engine parameters, mean values and standard deviations 
from actual and simulated data. This Is summarized in the form of predicted 
and actual values following one another; P for predicted and A for actual. 
These were all from engines with a previous record. As can be seen from 
Table 6.1.2A, the predicted and the actual standard deviations are often 
drastically different. Once again, looking at the HPOT discharge 
temperature channel B values, the engine-to-englne standard deviation for 
the predicted value at the 109% power level is 61.07373 while the actual 
value Is 118.6592 (almost double). 

Differences of the above mentioned nature raise the concern of using 
precomputed means and standard deviations for the SAFD. This fact Is the 
fundamental reason for choosing the first Incoming value of each parameter 
measurement as the basis for determining the actual mean value to be used by 
the SAFO during Its first two-second operation rather than using a 

precomputed value. 





6. 1.1.1 SAMPLE INCIDENT DESCRIPTIONS 

A sample of recent incidents are described in the following paragraphs: 

1. Test No. 902-426 

Scheduled Duration (SDUR) ■ 700 seconds 
Achieved Duration (ADUR)* 204.12 seconds 
Engine NO. 2106 
Date: July 1 , 1987 

Engine performance was nominal until engine start plus 163 seconds. At 
163 seconds, HPOT discharge temp in Channel A (CHA) began to rise 
Indicating the presence of a hot streak In the OPB Injector, HPOT 
discharge temp in Channel B (CHB) did not respond. The hot streak was 
localized and due to the rotating effect of the turbine, only a CHA 
sensor responded. 

Posttest examination revealed erosion of the oxidizer preburner Injector 
face and localized burn-through of the HPOTP turbine sheet metal 
adjacent to the injector erosion area. There was no external engine 
damage and heating was Isolated to the areas noted above. 

REDLINE PARAMETER - HPFT discharge temp sensors (231,232) dropped below 
their lower limit. Pneumatic shutdown was initiated because a hydraulic 
lockup was in effect (part of the test plan). 

/ 

OTHER PARAMETERS SHOW CHANGES 


879 

HX INT TEMP 

459-480 

HPFP DS PR-PREBURNER PC « AP.j 

459-410 

HPFP DS PR-PREBURNER PC * AP.j 

743 

HPOP SPEED 

200 

MCC PC AVG (new redline on this parameter was put after this 

201 


Incident) 

327-328 

HPOP BAL CAV AP 



V 


2. Test No. 902-471 
SOUR * 700 seconds 
ADUR = 147.06 seconds 
DATE: June 2, 1989 

The LPFD #3 flex joint bellows expanded due to a 0/S tripod leas break. The 
tripod missile ruptures a .035' wall in the LPF duct and a leak Is 
Initiated. Missile Impacts flow stralghtener and comes to rest. At start 
plus 147.43 sec. a fire is observed and at 147. 5B sec. the lower east 
thermocouple temp exceeds redllne of 635'R. The cutoff was initiated at 

147.64 seconds. 

REDLINE PARAMETER - Facility cutoff Initiated by PID 1493, lower east 
powerhead thermocouple redline resulting from hydrogen fire originating In 
the region of the low pressure fuel duct near the HPFTP. 


OTHER PARAMETERS THAT SHOW CHANGES 


270 

203,204 

2035 

827 

821 

233 

234 
86 
1021 
819 
43 
873 


Fuel density 

LPFP discharge Pr A,B 

Eng FI In Pr 3 
Eng FI In Pr 1 
HPOT ds temp A 
HPOT ds temp B 
HPFP in Pr avg 
Eng FI in T 
Eng FI in Pr 2 
MCC PC avg 
LOX Tank disch Pr 
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3. Test No. 904-044 
SOUR - 1337 seconds 
ADUR - 1270.72 seconds 
Date: June 23, 1989 

A bearing in the HPOTP failed. Non-flight configuration HPOTP post shutdown 
hydraul1c/H2 fire due to rupture of OPB preburner bowl D below girth weld. 
Pneumatic control assembly damage and main oxidizer valve actuator neck 
fracture prevented valve closure, propellant shutoff by prevalves. No 
facility damage, engine external minor fire damage, no expelled fragments, 
FPB/OPB, HPFTP, LPTPs, nozzle, MCC and main Injector showed no damage. 
Powerhead damage was Isolated to oxidizer preburner heat exchanger bowl. 
Data and hardware assessment pinpoint source of failure to HPOTP pump and 
bearings. 

REDLINE PARAMETER - MCC PC CH AV6 400 PSI less than Pc Ref. 

OTHER PARAMETERS THAT SHOW CHANGES 

40 OPOV ACT POS 

42 FPOV ACT POS 

371 MCC HG IN PR 

52 HPFP DS PR 

656 PBP BRG BK PR 

232 HPFT DS TMP 
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6. 1.1. 2 PRELIMINARY SELECTION OF TESTS FOR SAFD IMPLEMENTATION 

From the list in the previous Table (6.1.1) and from test histories, a 
preliminary selection of Incident tests was derived for the purpose of 
Implementation on the SAFD algorithm with real-test data. The selection was 
based on the need to cover a wide range of failure types. Thus, failures 
that have been simulated on the SAFD algorithm previously, failures that 
were representative of the most critical and most recurrent anomalies, as 
well as those that represented fast or slow occurring failures, were 
selected. The selected list of Incidents is presented in a Table (Table 
6.1.3) with their corresponding test numbers. 
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e.T.2 PAPAHFTER IDENTIFICATION (PID1 NUMBER ASSO CIATION WITH T Z S JS 


Every individual measurement parameter Is associated with a PID number for 
each specific engine test. These PID numbers often change from test to test 
and from engine to engine, since In some cases, new sensors are added and in 
others, existing ones are removed. Thus, the redistribution of the 
measurement sensors create the need to Identify the PID numbers for each 
test use In order to apply test data to the SAFD algorithm. 

Failure modes, according to the line replaceable units in the Failure Modes 
Effects Analysis (FMEA), are listed In Table 6.1.4. 

Test data processing of the SSME Includes storage of measurement data In 
computer files that only accommodate 9 PIDs per file (meaning 9 
measurements). This is apparently necessary for the failure mode effects 
analysis (FMEA) that is carried out after every failure occurrence. 

In order to make the above mentioned files compatible with the SAFD 
algorithm and make more than 9 measurements available to the SAFD algorithm, 
a conversion computer code is required. 

A computer program was written entitled CONVDAT (see Table 6.1.5), that can 
combine up to four (4) data files into one file (36 measurements) accessing 
them on the CDC computer NOS operating system. Each of the original data 
files must be transferred to the CDC system by using a special procedure and 
then edited as follows: 1) remove all blank lines, 2) edit descriptions 
into the following format - first line should give the description of the 
test (engine number, date, etc.) using a maximum of 60 characters. The 
second line should have the first PID number with descriptions, using a 
maximum of 30 characters. The third line should have the second PID number 
with descriptions, and so on, until the last PID number is covered, each 
using 30 characters or less. 


Once all the files have been converted the CONVOAT routine can be used in 
the following manner: 1) attach the first file to TAPE20, the second file 

to TAPE21 , the third file to TAPE22, and the fourth file to TAPE23; 2) 
change the first four lines to reflect the correct accounting Information. 
Following these steps the output file is generated in TAPE31 . Change the 
name of this file; 3) update the values of the parameters on the namelist 
SGIVEN. The parameters in the latter are defined as follows: 

NPID1 - number of PIDs on TAPE20 

NPID2 « number of PIDs on TAPE21 

NPID3 * number of PIDs on TAPE22 

NPID4 « number of PIDs on TAPE23 

TSTART = data start time 
TMAX - data stop time 

Following the above mentioned steps, the CONVDAT routine can be executed and 
all of the four files will be combined Into one file. 

6.1.3 UPDATING ANO FINALIZATION OF SAFD MONITORED PARAMETERS 

Presently, SAFD uses 24 distinct outputs from SSME Instruments. In the 
original list of SAFD monitored parameters there were some parameters that 
were totally removed from engine Instrumentation or eliminated as a 
redline. Such parameters are: 1) Injector coolant pressure (PID No. 366 

non-existent), 2) HPOTP primary seal drain pressure (PID No. 951, eliminated 
as a redline). From the SSME FMEAs list of the highest ranking failures, 48 
engine parameters were selected that encompass measurements related to 
HPFTP, HPOTP, LPFTP, LPOTP, HEX, MCC, HGM, OPB, FPB, Main Injector, OPOV, 
FPOV, CCV, and Nozzle. From these parameters a list of 24 of those 
parameters that have the potential of Indicating a failure In the shortest 
possible time was selected as the final list for SAFD monitoring. The lists 
of the original and current SAFD monitored parameters are shown In Tables 

6.1.6 and 6.1.7, respectively. 
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Nine of the original parameters were deleted and eleven new ones were 
added. Those deleted were: 1) Injector coolant pressure (366), 2) MCC HG 

In Pc (367), 3) FPB Pc (410), 4) OPB Pc (480), 5) MCC CLNT Dls. Temp. (IB), 

6) engine OX Injector pressure (858-859), 7) LPOTP pump dls. pressure (302), 

8) HEX Inlet pressure (878), 9) HEX inlet temp. (879). 

6.1.4 SSME CRITICAL OPERATING PARAMETERS: A COMPARISON BETWEEN NOMINAL 

(PREDICTED) VALUES AND ACTUAL ENGINE DATA 

In Table 6.1.8, the engine parameters that are predicted prior to a test and 
compared with actual data from several tests on each of three SSMEs (2107, 
2011 and 2024), are summarized. The values herein are at 1 09% power level 
and are selected at specific time Instants as Indicated in the Table. The 
last two columns list the corresponding nominal values (those values that 
are picked when a brand new engine Is tested) and their engine-to-englne 
standard deviations (SD) calculated from a randomly selected set of actual 
hot-fire test data (the very last column). As can be seen In several of 
these parameters, the difference between the actual and nominal values could 
be greater than three times SD (3 sigma). Examples of these are: 1) HPFP 

speed, difference between nominal and actual value Is about 753 rpm while 
the SD is 107; 2) HP0T DS TMP, difference between actual and nominal is 

about 104 and the SD Is 33; 3) OPOV position, difference between actual and 
nominal Is about 6.24 and SD is 1.89. The reason for evaluating such 
differences Is the fact that the SAFO algorithm presently needs a 

precomputed mean value for each parameter to check on failures during the 
first 2-second Interval after the algorithm starts. Two of the five 

simulations that was performed during the Phase I and II studies, test 
901-340 was shut off due to a "false alarm" for the only reason that the 
Input mean values were much further off from the actual values than 3 
sigma. Thus, if such false alarms are to be avoided as much as possible. It 
is more judicious to choose a mean value that Is closest to the first 

Incoming measurement output for each parameter that can be picked up at the 
very start of the SAFD algorithm, as soon as the measurements are sensed. 
The final approach to such a choice of the starting mean value should be 
decided upon after careful analyses of existing mean value predictions and 
their corresponding SDs. 
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6.1.5 CHARACTERISTIC EFFECTS OF PRESURIZATION AND VENTING ON SAFD 
PARAMETERS 

During SSME testing, the LOX tank or the fuel tank, or both are either 
pressurized or vented several times during the course of a test in virtually 
every test. These pressurizations/ventings effect some of the parameter 

values over and above the power level variation effects. Thus, at least 
eleven of the 24 new SAFD monitored parameters are effected by the 
venting/pressurization of especially the oxygen tank. Moreover, closure of 
the fluid or the GOX repressurization valves also has some effects on 
parameters such as the HPOP and the low pressure fuel pump speed, as well as 
the FPOV actuator position (see Figures 1 and 2). Analyses on various 

engine data with and without LOX venting was carried out and the results are 
sunmarlzed In Table 6.1.9. Clearly, almost all parameters are effected, but 
only about half are significantly influenced to be considered In 

simulations. Well-defined plans exist to Incorporate the effects of such 
venting and pressurizations as well as of repressurization valve closures on 
the SAFD parameters using existing SSME -influence coefficients." Thus, a 
special formula exists that will provide the actual value of any SSME 
parameter under a given power level and at steady-state conditions. This 
formula will be utilized to compute varying averages (in a piecewise linear 
manner) for those parameters effected and a safety band will then be placed 

around the actual average value of the parameters. This will provide a much 

healthier approach to failure detection under the above mentioned 

perturbations. 

6. 1.5.1 TIME-SLICE TO TIME-SLICE STANDARD DEVIATION VARIATIONS DUE TO LOX 
VENTING 

A separate study was undertaken to assess the Influence of LOX venting on 
various SSME parameters under various time Interval calculations of the 
standard deviations (SD). As expected, when the SO of most parameters were 
calculated during very short time Intervals (less than 1 second) the values 
obtained were low. However, the SD steadies as it is calculated during 

intervals longer than 1 second. Some parameters show an increase in SD due 
to transient effects, such as LOX venting, while others show a decrease. 
Moreover, all parameters show a level of stabilization of the SDs after two 
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seconds. This is a relevant result, since In the present SAFD algorithm the 
SD for each parameter will be calculated on-line during the first two 
seconds from the start of the algorithm. Thus, the two-second interval 
calculated SD should be close to the actual slice-to-slice engine SD. 
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6.2 


SAFO ALGORITHM AND SIMULATIONS 


The original configuration of the SAFD algorithm encompassed three 

approaches to failure detection. The first. Approach 1, used during the 

first two-second period from the termination of a transient, involves 
utilizing precomputed average values and standard deviations (SD) for each 
parameter and setting up a 3 -times-the-standard-devlation band above and 
below the average values for limit checking. Thus if a signal violates 
these band limits then a warning would be flagged out. If several of such 
flags are available at any Instant, engine cutoff Is Initiated. 


In Approach 2, the average value calculated for each parameter during the 
first two-second period after a power transient was fixed at the end of the 
two-second Interval for the rest of the steady-state operating regime. 
Moreover, the moving average (MA) taken during the first two-second interval 
was continuously updated every 80 milliseconds during the course of 
algorithm operation (by dropping Its last/earliest measurement and picking 
up and adding the current value of the Incoming measurement and thus, 
calculating the new MA). The last MA for each parameter value was compared 
with Its corresponding limits for faults. The limits herein were narrowed 
down to one precomputed SD above and below the averages. The third. 
Approach 3, also used the same safety band of one SD on each side of the 
average for limit checking but It utilized the on-line real-time running 
average Instead of the fixed one as a mean value. Herein actual data was 
used for comparison with the limits. The latter two approaches were active 
after the first two-second Interval of algorithm start. 


The above three approaches were carefully studied and analyzed and It was 
concluded that the two-second long running average is too Insensitive to 
changes In the SSME. Thus, It was decided to compute MAs at each 

measurement step (40 milliseconds In CADS output with an option of 20 

milliseconds, hardware permitting), for five (or 10) of the last consecutive 

measurements and to continuously update It by dropping the very last 

(earliest) of the measurements and adding on the current value to get the 
average of each parameter. Moreover, a standard deviation is also computed 
on-line real-time during the first two-second Interval after algorithm start 


and that value is used to arrive at a 2N* SD bandwidth for limit/trend 
checking (N*SD above and one below the average value). However, to 
determine the validity of such an approach, values of SDs (engine-to-englne, 
run-to-run, slice-to-slice) from actual test data were evaluated by 
computing them from various time slices, with different sampling intervals, 
to find out about their variations. This helped determine if the standard 
deviation from an Initial two-second data of a steady-state condition does 
actually reflect the true standard deviation of the whole steady-state 
period of the monitored parameters and if such an approach will not lead to 
premature cutoff. It was found that N has to be quite large in some cases 
in order to provide a sufficiently large bandwidth that will avoid false 
alarms. This is due to the fact that the calculated SD reflects only the 
sensor noise levels and does not Include the effects of other excursions due 
to transients (such as repressurization or venting) and nonlinear behavior. 
Also, work was performed on sensitivity studies regarding the effect of 
averaging Intervals on the average values and the overall performance of the 

SAFD algorithm. 

6.2.1 SAFO OBJECTIVE AND SCOPE 

The main objective of the Real-Time Failure Control contract Is to develop a 
real-time failure detection algorithm that Is signal-based and that detects 
anomalous behavior of the SSME earlier than the existing redline system. 

The SAFD works, as It currently stands, only during SSHE steady-state test 
conditions. It utilizes both low and high frequency measurement signals 
from 24 key parameters that are currently monitored. However, the option of 
expanding the monitored parameter list would not require extensive effort. 
Eight of these parameters are facility and 16 are CADS. All major redline 
parameters are included In the SAFD, based on the fact that all these are 
key to a safe engine operation. 


6.2.2 THE CURRENT SAFD ALGORITHM 


The SAFD algorithm In Its present configuration starts at 5 seconds after a 
start transient or 2 seconds after the completion of a scheduled power 
transient. As a safety feature, the first measurement values (after 
algorithm start) of all the 24 monitored parameters are checked against 
safety limits formed by placing a safety band of N*SD p , where N Is a 
predetermined multiplying factor (normally 4) and SD p is the precomputed 
SO. If several parameters (the number of which should be decided prior to a 
test, usually between 3 and 6) violate these limits then an engine shutdown 
Is signalled. This check will detect any anomalous behavior that could have 
developed during start or a power transient. If no failures are detected at 
the first Instant then the measurement values of the 24 parameters are 
chosen as the mean values for the next 2-second interval of the algorithm 
operation. During this time an on-line real-time SD and a moving average 
(HA) Is calculated that is the average of 200 milliseconds worth of data for 
each parameter. This MA Is updated at every sampling interval (40 
milliseconds for the CADS and 20 milliseconds for the facility) by dropping 
the last value of the measurements and picking up and adding on the most 
recent one. This MA Is checked against a safety band formed by placing 
safety limits around the above mentioned fixed average (the first Incoming 
measurement value) of N^* SD bandwidth (where N^ is a weighting 
factor normally taken to be 3). If several parameters simultaneously 
Indicate anomalous behavior then engine shutdown Is signalled. 


If no anomalies are detected during this two-second Interval then the last 
computed MA Is fixed as the mean value (MV) for each particular parameter 
for the rest of the algorithm operation (until another scheduled power 
transient). A safety band Is formed around this fixed MV by placing limits 
above and below it of N 2 * SD C (where N 2 Is a weighting factor and 
SD Is the calculated SD). Then the on-line MA, that Is continuously 
being updated, is checked against these safety limits at every sampling 
Interval. If several parameters Indicate violation of the safety limits 
then engine shutdown Is signalled. 

This process is stopped at every scheduled power transient and is re-started 
two seconds after the completion of these power transients. For a visual 
picture of the algorithm operation see the schematic In Figure 3. 


6.2.3 SAFD REFINEMENTS 


The SAFD algorithm was further modified (from its Phase I and II condition) 
to Incorporate all the 24 newly selected parameters (Table 6.1.7) and to 
acconmodate the 200 millisecond MA and the SD calculated during the first 
two-second interval. Moreoever, actual test data from incident tests was 
transferred to the CDC system and all the errors and discrepancies in the 
data files were eliminated for processing. Most of these tests resulted In 
a premature redline cutoff due to a failure. Test data was then combined 
Into two data files, one for the facility data and the other for the 
controller data. A SAFD Input file that Included most of the 24 SAFD 
parameters, was also prepared for each test and the algorithm was executed. 
Several adjustments are always needed (during SAFD simulations with real 
test data) for the data to be completely usable by the SAFD under all power 

levels. 

Modifications to the model were made to incorporate new failure detection 
shutdown criteria over the first two-second interval following a scheduled 
transient. The new approach involves using the first measurement data as 

the mean value of each parameter In the shutdown logic for this Interval. A 
set of precomputed SD values for the new parameter list must be selected and 
Incorporated into the model for each test. These SD values are required for 
the one-time comparison with the "nominal" (to check for anomaly) and for 
the shutdown logic over the two-second Interval following a transient. 
Moreover, the only time nominal values for key SAFD parameters will be 
needed Is during the first Instant when the actual measurement data is 
received. Here the nominal will be compared with the actual and If the 
difference is greater than 4 SD, this will be considered anomalous 
behavior. During the follow-on work logic will be Included so that the 

model will accommodate transient behavior, occurring as a result of 
scheduled LOX and fuel venting, without interpreting these transient 
behavior occurrences as failures. 

The above mentioned (Phase I and II) three fundamental approaches were 
considered in the refinement the SAFD algorithm, as was described earlier. 
The underlying purpose of these refinements was to enhance the algorithm 
performance, especially for avoidance of premature cutoff. One of the 
principal reasons for premature engine cutoff Is sensor failure. The SAFD 
currently does not address this type of failure. Thus, special algorithmic 



and software tools need to be studied that can increase the capability of 
the SAFD algorithm to address sensor failures. One way to accomplish 

detection of sensor failures Is to consider a single anomalous output as due 
to the failure of the corresponding Instrument while all the remaining 
outputs are normal. This approach needs to be studied further and such 
cases should be simulated with the transient model. 

Additional refinements to the SAFD algorithm were also looked at. One such 
refinement is the new "slope-average approach," which entails monitoring the 
slopes between consecutive averages. Thus, the difference between each pair 
of consecutive averages Is divided by the time Interval separating them and 
the answer is considered as the slope-average. The advantage of such an 
approach Is that it produces very sensitive outputs of signals that have 
minimal noise (since the sensor noise is "filtered" out by taking 
averages). Moreover, anomalous trends can easily be detected through 
evaluation of the sign of the slope-average and whenever there Is a trend of 
positive or negative slopes for a few consecutive intervals, then there is a 
potential failure. This approach needs to be carefully simulated for 
evaluation relative to failure detection and sensitivity to failures. 

Preliminary simulations were carried out on actual incident test data and 
plots were generated for various parameters. The plots show the parameter 
signal, the on-line average, and the fixed average, as well as the 
slope-average. Moreover, the plots Indicate that the slope-average could be 
used as a reliable indicator of anomalous behavior with the potential of 
earlier detection compared to the SAFD algorithm In some cases. For 
example, the increasingly positive trend of the slope-average of the three 
parameters shown In Figures 4A, 4B, and 4C beginning at about 209 seconds, 
indicate that the slope-average approach could provide detection of the 
particular transient at an earlier time than the SAFD algorithm. The 
slope-average profiles suggest that this test could have been shut down 
earlier, perhaps at about 209 seconds, as opposed to the SAFD algorithm 
cutoff time of 214.79 seconds. 
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6. 2. 3.1 SAFD REFINEMENT COMPARISONS 


In order to compare the performance of the SAFD algorithm with and without 
refinements, two SSME hot-fire tests (901-284 and 901-364) were considered. 
Three cases for each test were simulated (Cases I, II, III). The first of 
these tests was a failure that occurred during the first 10-second period 
due to a Lee Jet anomaly. This caused the measurement values of parameters 
to be off nominal and eventually the redlines cut the engine off at 9.88 
seconds. The original SAFD simulation had used a recomputed nominal MV and 
SDs as well as actual test values for five of the parameters as follows: 


Parameter Precomputed Mean Actual Value 


1 . 

HG Inj. delta P 

255 

151.28 

24.53 

2. 

HPFT delta P 

1860 

1270.5 

20. 

3. 

HP0TP delta P 

1800 

918.58 

46.5 

4. 

HCC Pc 

2995 

1829.5 

21 .2 

5. 

MCC clnt dis. temp. 

420 

757.97 

6.3 


Variations between the actual values and the precomputed mean for each of 
these parameters being larger than three (3) times SO, the original SAFD 
algorithm cut off the engine after the first Iteration. A similar "false 
alarm" occurred In test 901-340 simulations with the SAFD algorithm. In 
order to evaluate the algorithm performance. Approach 1 (working during the 
first 2-second Interval) was shut off and Approach 2 and 3 were used. With 
the original SAFD algorithm, engine cutoff occurred at 8.86 seconds while 
with a 200 msec running average and an on-line computed SD, the cutoff was 
at 7.94 sec and 7.14 sec respectively. Similarly for test 901-364 (see 
Table 6.2.1). 

In the above mentioned three cases for each test, the following were 
performed: 

1) In Case I, a precomputed SD and the 2-second (50 measurement) MA 

were used for limit checking at each 40 millisecond Interval. 





2) In Case II, a precomputed SD was used during the first 2-second 

interval and a band of 3-SD was put below and above the precomputed 
MV (as in Case I); but after the 2 seconds the SD, that was 

computed during the first 2 seconds, was weighted and used for 
assigning similar but lower limits. The limit checks were again 
performed by the 2-second (50 measurement) MA every 40 milliseconds. 

3) Case III Involves a 200 millisecond MA (every 5 measurements) but 

also a calculated (during the first 2-seconds) SD weighted 
appropriately and used to assign limits around the calculated mean 
value. 

Test 901-364 was used once again, to compare performance of SAFD with and 
without refinements. Thus, even though there was no failure at 216.71 

seconds (the original point of SAFD Phase II simulation cutoff), the signals 
were showing a trend that provided a good base to check the algorithm 
performance. It should be pointed out that there was a L0X tank 
pressurization at 200 sec. and this was the reason for the trending of many 
of the parameters that were used to test SAFD. However, there was a real 
failure that was detected by the engine redlines at 293.15 sec., which was 
or was not related to this transient effect. As far as the algorithm is 
concerned, these kinds of transient signals are similar to actual failures 
In behavior and can be used to do some performance and sensitivity 
analysis. The actual failure was also analyzed through the algorithm to 
compare with the red line. 

In Tables 6.2.1 and 6.2.2A,B,C,D,E,F, a comparison can be made of the N2*o 
values (upper/lower signal limits defined by mean ± N2*o) between Case I 
and Cases II and III. For most parameters, the N2*o values are larger for 
Case I compared to Cases II and III, yielding more generous upper and lower 
signal limits. Upper/lower signal limits as close to the signal mean as 
possible, without being so restrictive as to trigger a false alarm, are 
desired to facilitate SAFD failure detection at the earliest possible time. 
The simulation results for the three cases, for each of the two tests, are 
presented In the above mentioned Tables. 
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6.2.4 SAFD ALGORITHM SIMULATIONS 

Several cases of real-test data from major Incidents were applied to the 
SAFD algorithm to evaluate and understand Its strengths and weaknesses. 
Also, sensitivity studies were carried out to evaluate the effects of: 

1) averaging at 40 msec., 80 msec., 120 msec.. Intervals; 2) the weighting 
factor N for the determination of the safety bandwidth for each parameter; 
and 3) the number of anomalous parameters required for a decision for engine 
shutdown. The results of the simulations are presented in what follows. 

6. 2. 4.1 ALGORITHM SIMULATION OF TEST 750-285 

SAFD model simulation results of SSME hot-fire test 750-285 are presented 
herein. Tests 750-285 experienced a premature engine shutdown due to the 
development of a small fuel leak downstream of the main fuel valve in 
downcomer #8 around 204 seconds following start. The fuel leak resulted In 
a fire and was detected by a powerhead thermocouple red line, triggering an 
engine shutdown at 223.56 seconds. This test was conducted over a single 
power level (109X) and did not Involve propellant venting and 
repressurization, or propellant transfer. 

SAFD model simulation was initiated at 100 seconds following engine start. 
Since the fuel leak was small, only a small number of parameters were 
affected. Seventeen of the twenty-four SAFD parameters were available for 
simulation. About eight of these parameters appear to reflect the failure. 
For each set of figures, the Figure 5-1 shows the measurement signal, and 
the Figure 5-2 shows the SAFD signal average and upper/lower signal limits. 
Several simulation runs were made while varying the signal upper/lower 
limits (1 .e. , variations in n) for each of the eight parameters which appear 
to reflect the failure. The best of the simulation runs obtained resulted 
in SAFD shutdown at 212.48 seconds, compared to the redllne shutdown at 
223.56 seconds, due to detected anomalies In the oxidizer preburner oxidizer 
valve (0P0V) actuator position, the HPFTP coolant liner pressure, and the 
HP0TP Intermediate seal purge pressure. Table 6.2.3 shows the composition 
of the signal limits (defined by AVG ±n*SD) for selected parameters, l.e., 
the average, standard deviation, and n values. The average and standard 
deviation values are computed over the first two seconds of the algorithm 
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operation and are fixed at the end of this Interval. The signal limits can 
be adjusted by varying the values for n. A careful review of Figures 5A-1 
through 5H-2 will reveal that an attempt to reduce the SAFD signal limit 
bandwldths will result In a false alarm. This is the case when an attempt 
Is made to reduce the signal limit bandwidths for those parameters that 
appear to reflect the failure (Figures 5A1 through 5H2). A false alarm 

would result due to signal average variations prior to the real anomaly 
occurrence. 

As an example, consider the parameter of Figure 5F1-2, the low pressure 

oxidizer pump discharge pressure. While Figure 5F1 indicates the anomaly 
should be detectable sometime following 205 seconds. Figure 5F2 reveals that 
because of the signal limit values In relation to the signal average, 
reducing the signal limits by lowering the value for n would result In a 
false alarm by the upper limit prior to detection of the real anomaly by the 
lower limit. This of course Is a direct result of the particular average 
value used In the signal limit definition of this parameter. 

Values for two of the algorithm variables - #P (number of simultaneously 

occurring anomalous parameters required for shutdown) and n (factor which 

determines signal limits) - must be predetermined. The values selected for 
these variables can affect the algorithm's performance dramatically, In 

terms of both Its reliability and Its advantage over the redline technique. 
Selection of the #P value should be large enough to insure a reliable and 
accurate failure detection, yet small enough to allow the algorithm to 

respond to a potential failure early. Selection of the n value is critical 
to reasonable signal limits for the parameters. If the selection for n is 
too small, the signal limit bandwidths will be too small, possibly resulting 
In a false anomaly detection. An unnecessarily large selection for n will 
not facilitate early anomaly detection and may even prevent detection of 
anomalous behavior. Selection of a value for n to serve all parameters 

optimally Is difficult since the signal amplitudes and frequencies of 

oscillation vary greatly among the parameters. However, Ideas exist that 
will lead to the development of an automated approach to the selection of n 
and #P that can be worked on during the next phase of this program. 

Simulation results for test 750-285 reveal that a single n value should not 
be used for all parameters to achieve accurate results. It is necessary to 
optimally choose an n value appropriate for the behavior of each parameter. 


6.2.4. 2 ALGORITHM SIMULATIONS OF TESTS 901-340 AND 902-471 

SAFD model simulation results of two SSME hot-fire tests which experienced 
failure are presented herein. Test 901-340 Involved failure of the high 
pressure fuel turbine (HPFT) and was shut down at 405.5 seconds by the HPFT 
discharge temperature redline. Engine damage Incurred included HPFT 

turnaround duct wall fractures and torn sheet metal, and secondary rotor 
platform seal fractures. The results of simulating this test with the SAFD 
algorithm are presented in Table 6.2.4. Four simulation runs, involving 
algorithm cutoff by Approach 2, are shown for variations in the Approach 2 
signal upper/lower limits (l.e., variations in n2) and In the number of 
parameters experiencing anomalous behavior simultaneously required for the 
algorithm to signal a shutdown (l.e., variations In #P). The three cases 
for n2*26 and #P=6,7 and 8 resulted In test shutdown by Approach 2 (after 
the first two-second Interval) at 279.67 and 295.42 seconds for #P=6 and 7, 
respectively. The case for #P=8 did not result In a shutdown, however. 
Indicating that fewer than eight parameters had signals outside of their 
respective upper/lower limits simultaneously at any given time. A case was 
also simulated with a slightly larger bandwidth around the signal mean 
(n2*27) with #P*7. For this case, the algorithm signalled a cutoff at 298.7 
seconds, later than the comparison case for n2-26 and #P*7, which had a 
cutoff of 295.42 seconds. The simulation results for selected parameters 
for the case with n2«26 and #P=7 are shown graphically In Figures 6A1.A2 
through 6F1.F2. Both the parameter measurement signals and the algorithm 
signal means, with the earliest anomaly time, are shown. For the case with 
n2»27, l.e., larger bandwidths around the means, and #P*7, some of the 
parameters reached their respective signal limits at slightly later times. 

The second simulation was of test 902-471 which Involved a hydrogen fire 
originating In the region of the low pressure fuel duct near the HPFTP due 
to a leak. This test was shut down prematurely at 147.68 seconds, initiated 
by the lower east powerhead thermocouple redline. The simulation was 
performed for the hot-fire test data from 50 seconds, at 100* power level, 
to the time of the redline cutoff at 147.68 seconds, at 104* power level. 
The power level change from 100* to 104* was at 140 seconds. Since the 
algorithm is for steady-state operation only, simulation was performed In 
two stages corresponding to the two power levels. Simulation for the first 


stage was from 50 to 139 seconds, and for the second stage was from 145 to 
147.68 seconds. The simulation results are presented In Table 6.2.5. Seven 
simulation runs are shown for variations in nl, i.e., in the Approach 1 
signal limits, and in #P. In all cases, the algorithm signalled a shutdown 
by Approach 1 during the second power level (104%) . There are five cases 
for nl-2.5 and #P=4,5,6,7 and 8 showing the later algorithm shutdown times 
as a result of increasing the number of simultaneous anomalous parameters 
required for algorithm shutdown. A simulation run was also made for nl=2.0 
and #P=6 which resulted In a premature shutdown by the algorithm. This case 
Indicates the signal limits did not encompass a large enough bandwidth 
around the mean. A simulation run performed for nl*3.5 and #P=6 in which 
the algorithm did not trigger a shutdown indicates the bandwidth was too 
large. The simulation results for selected parameters for the case with 
nl*2.5 and #P=8 are shown graphically In Figures 7A through 71. The 
parameter measurement signals are shown Indicating the earliest anomaly time 
for the respective parameters as detected by the algorithm. Both of the 
above tests were without venting/pressurization. 
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6.2.5 HEURISTIC EVALUATIONS AND SENSITIVITY ANALYSIS 

Several simulation runs were carried out using the SAFD algorithm on SSME 
test data from test 901-340. During this test a redllne shutdown occurred 
at 405.5 seconds from start due to a HPFTP failure (HPFTP turnaround duct 
bulged cracked and tore). The original SAFD algorithm simulations had 
engine cutoff after 0.08 sec. from the start of the algorithm, which of 
course, was a "false alarm." The false alarm was apparently due to the 
large difference between the precomputed mean values for the various engine 
parameters monitored by SAFD and the actual values from the test data. 
Thus, in order to avoid such premature cutoff, mean values closer to the 
actual data were selected and, using three times the standard deviations 
(SO), safety bands were set around each, to be used for the first two-second 
interval. Moreover, SDs were computed on-line during the first two seconds 
of the SAFD running and were used (after multiplication with an appropriate 
factor N2) to set the safety band around the monitored parameters. The 

measurement signal averages were also completed during the same interval and 
the value obtained fixed as the working mean value throughout the 
simulation. The comparative averages were updated every 40 -millisecond 
Interval using the latest 50 values. Presently, the last 5 values will only 
be utilized for an updating of the above mentioned averages every 200 
milliseconds (eventually, when data is available every 20 milliseconds, the 
last 10 values will be used to update the average every 20 -millisecond 

interval). 

Various sensitivity analyses were performed on this test by varying the 
multiplication factor N2 on the SD as well as the number of parameters, 
experiencing anomalous behavior that was required for the SAFD algorithm to 
trigger engine shutdown. Some of the results are presented in Table 6.2.6. 
The SAFD simulation results for the four different runs are presented in 
Tables 6.2.7A through 6. 2. 70 while Figures 8A through 81 show the signal 
profiles for some of the parameters. As shown In Table 6.2.6, varying N2 
and the number of parameters required for shutdown effect the outcome. 
Thus, appropriate values for each of these should be carefully selected. 




6.3 SSHE DIGITAL TRANSIENT MODEL FAILURE SIMULATIONS 

The SSME digital transient model (DTM) was used to simulate actual SSME test 
failures. The SSME transient model Is a modular digital computer program 
which Is being run on the CONVEX computer using a SUN workstation as the 
front end system. This particular version of the model has evolved from 25 
years of simulating rocket engine transient performance. Several 
generations of engines have been simulated and great confidence is placed in 
the predictions of these transient models. 

The simulations of real engine failures were done for the following 
reasons. First, as a preface for the use of the model, on-line with the 
SAFD algorithm, to create a closed-loop demonstration of the SAFD 
algorithm’s capabilities. Second, to gain increased confidence in the 
model’s ability to simulate engine failures, and third, to use the SSME 
transient model to simulate certain failure modes that are hypothetical and 
have not occurred on actual engines. 

6.3.1 DTM SIMULATION OF TEST 901-284 

Several of the actual engine failures were simulated by the SSHE OTH. The 
description of the failures and examples of the model output for each of 
these tests are presented with heuristic evaluations. 

The effort to simulate measurement and component failures took longer than 
expected. The fundamental difficulties In simulating actual failures by 
using the SSME digital transient model entail: 1) Imperfect matching of 
parameter variations caused by actual failures with the simulated values due 
to the highly nonlinear dynamics of the SSME, 2) errors In the predictions 
of the actual source or cause of failure from effect. Thus, If the cause of 
a failure Is pinpointed exactly, then the simulations will Indicate very 
closely matched behavior relative to the actuals. However, even if the 
exact cause of a failure In the system Is known, being nonlinear as it Is, 
It Is very difficult to get 100% correlation between actual and simulated 

behavior. 
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In certain situations, the Inverse approach Is more efficient. Namely, to 
start with the effects and to try to get to the cause, as In the case of 
efficiency variations. However, the SSHE. being very complex and having 
nonlinear dynamics, there are multiple causes that could result In certain 

effects and vice versa. 

6.3.2 TEST 901-284 

During the Incident test 901-284 the following failure was experienced: 

1. Channel B of the controller cut Itself off at 3.25 seconds. 
Channel B shutdown was caused by failure of electronic components 
In the facility power supply. 

2. At 3.9 sec, the Lee Jet orifice, used to purge Channel A Pc 
transducer passage, became dislodged and caused the Pc transducer 
to sense MCC coolant flow pressure Instead of Pc. This erroneously 
high reading (3800 psl) caused the controller to close the 0P0V to 
reduce Pc to the desired 3012 psl. A few milliseconds later, the 
controller calculated a mixture ratio of 9.0 and commanded the FPOV 
full open In an attempt to reduce the MR to 6.0. 

a. The Irmiediate results of the controller action, based on an 
erroneous Pc, was operation In an abnormal mode, characterized 
by high fuel flow and low turbine inlet temperatures of the OPB 
and FPB. In fact, the OPB Inlet temperature fell quickly to 
about 440 # R (-20°F) which assured freezing of the water which 
makes up 10% of the total 40 lbs/sec. 

b. The ultimate result of the controller actions was a fire in the 
HPOTP at 9.7 sec due to rubbing In the area of the LOX primary 
seal sllnger. The rubbing was caused by a high axial load 
which displaced the rotor assembly at the pump end of the HPOTP 
housing. This high axial load was caused by Ice formation in 
the cavity between the housing and the 2nd stage turbine wheel 
which resulted In reduction In the cavity pressure from about 



2500 psi to near ambient. This reduced pressure on one side of the 
turbine wheel and caused an estimated Increase In rotor axial force of 
about 31,000 lbs, which far exceeded the control capability of the 
balance pistons to control the position of the rotor. 

Plots were generated from simulated data of the above mentioned test and 
overlayed on actual plots from real-test data (see Figures 9A-9L). The 
parameters indicate very close matching of real data with simulated data, 
thus indicating the accuracy of the DTM. 
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6.3.3 TEST 902-428 


Computer simulation results of the Incident test 902-428 are presented In 
this subsection. At the 163rd-second from engine start of this test, 

OPB injector experienced a hot streak. Thus, the HPOT discharge temperature 
channel B (PIB No. 234) sensor Indicated significantly higher than normal 
temperature reading throughout the test. 

Figure 10A shows the main combustion chamber pressure model with the test 
data overlayed. Figure 10B has the overlays of the HPOT discharge 
temperature, channel A. Figure IOC has the HPOT discharge temperature 
channel B reduced by 170*11 (due to It running 170*11 over normal) overlayed 
with the Olgltal Transient Hodel (OTM) results. The heat exchanger 
Interface temperature (HXIT) was one of the parameters where the failure was 
dramatically exhibited. The present configuration of the OTH output does not 
include this parameter. But for this case, the OTH was modified to Include 
this parameter as an output. The actual HXIT Is measured during hot-fire 
tests only after oxidizer coolant Is mixed Into the flow, which t en 
reflects a slightly different value. Hence, the model value only Is shown 
In Figure 10D. For a comparison between the actual HXIT and the mode , 
Table 6.3.1 below represents the percentage change of the parameter value 
during the time Interval shown (column 1). the value calculated by the model 
(volumn 2), the net percentage change occurring from first to the second 
time-instant (column 3). the actual measurement values (column 4) and t e 
net percentage change (colume 5). In Figures 10E. 10F, and 10G, overlays o 
chamber mixture ratio, fuel prebumer and oxidizer preburner pressures are 

presented, respectively. 


TABLE 6.3.1 


TIME 


HODEL 
T0T2MIX 
Value AX 


TEST 

HX TEMP 879 
Value AX 


160 

170 

180 

185 

190 

195 

200 


1335 

— 

1340 

0.37 

1350 

1.12 

1355 

1.50 

1320 

-1.12 

1225 

-8.24 

1165 

-12.73 


915 

— 

920 

0.55 

930 

1 .64 

934 

2.08 

940 

2.73 

910 

-0.55 

847 

-7.43 
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6.3.4 TEST 750-285 


Simulations of the Incident test 750-285 that occurred on the SSME on 
Hay 21, 1987, on engine 0210 while operating at 109* power level are 
presented herein. The test was cut off prematurely at 223.6 seconds of a 
planned 295 seconds, when the powerhead temperatures at the CCV and HPFP 
exceeded the redllne setting of 660*R. At approximately 204 seconds Into 
the test, the nozzle #8 downcomer began to leak hydrogen. The posttest 

analysis Indicated leakage flow to be between .5 and 1 lb/sec, but because 
of the complex geometry and difficult access to the downcomer, an accurate 
leak size assessment was precluded. The nozzle was replaced before the next 

test. 

In order to model this failure, a flow path was added to the calculation of 
flow exiting the downcomer area. This additional flow was set to equal the 
leakage flow. The leakage flow that was Included In the pre-test notes of 
the next test was Initially Input In the model. This flow had a maximum 
leakage of .6 lb/sec. This amount of leakage had a negligible effect on the 
DTM engine parameters and did not match the test data. Next, the leakage 
flow was doubled and the model was re-run. The amount of leakage the model 
experienced is shown In Figure 11 A. This has a maximum of 1.2 Ibs/sec, 
close to what the posttest analysis indicated. This amount of leakage 
caused the model engine parameters to match better with the test data. 

Figure 11B shows the high pressure fuel turbine discharge temperature traces 
from the test data and the transient model. The transient model trace has 
150°R added to It. This was done because the test 750-285 ran at a higher 
temperature than Is nominal for this power level. The relevant part of this 
plot Is the temperature trend. Figure 11C shows the high pressure oxidizer 
turbine discharge temperature traces from the test data and the transient 
model. The transient model trace has 90»R added to It, for the same reason 
as mentioned above. Figure 110 shows the oxidizer preburner oxidizer valve 
’position traces from the test data and the transient model. The dead band 
for this valve Is a few tenths, so this Is a good correlation between the 
test and the model. Figure 11E shows the main combustion chamber pressure 
traces from the transient model and the test data. Figure 11F shows the 
engine mixture ratio traces from the test data and the transient model. 
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6.4 SSME DTK HYPOTHETICAL FAILURE SIMULATIONS 

There are various potential failures that have never occurred. It would be 
desirable for the SAFD algorithm to have the capability of detect1n9 *"» 
such failure. Thus, a study was performed that entails use o e 
to simulate the aforementioned types of failures. The Intent Is to uti lie 
the resulting simulation on the closed-loop (DTM-SAFO) system and assess the 
performance of the SAFD algorithm In detecting such hypothetical failures. 
While the DTM provides on-line engine data to the algorithm. 

Leakage of fuel or oxidizer Is one of the major Incidents that could be 
catastrophic and that is hard to detect. Moreover, the quantity of 
fuel/oxidizer leakage that can be tolerated, so that the engine cou 
continue to run satisfactorily, depends on the location of the leak. Thus, 
if a fuel leak is just downstream of the main fuel valve (MFV) its effec 
will be divided among the three parallel flow paths that branch from the MFV 
discharge duct. These Include the main combustion chamber and the nozzle 
cooling channels, and the coolant control valve. Therefore, quite a large 
leak can sometimes occur without having a major Impact on any one ow 
parameter. If. on the other hand, a leak occurs just upstream of the ow 
pressure fuel turbine, its effect will be significant on one flow path. 
Hence, small leaks can only be tolerated in such instances. It should be 
noted that any fuel leaks are hazardous and should be detected as early as 

possible. 

6.4.1 RUPTURE IN OXIDIZER PREBURNER PUMP AREA 

Simulating leaks with the DTH requires some effort of modifying several 
parts of the model by Introducing additional flow paths. In such an 
undertaking, a rupture In the SSME oxidizer preburner pump area was 
simulated. The rupture was assumed to take place on the oxidizer s e, 
downstream of the preburner pump (see Figure 12). An additional flow path 
' for the leak, that would flow from the ruptured area, was Incorporated In 

the model. 
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Three separate runs of the model were made, with a leakage of 1 lb/sec and 
5 lb/sec leakage. The results of each run are presented in figures 
through 1 2 J and 12k through 12T. respectively. The engine power level was 
assumed to be 104* during the leakage Initiation time at 30.0 seconds, a ter 
system steady-state Is reached. The engine control system compensated for 
the leakage flow by opening the OPOV and FPOV (see Figures 7.8.17. and 18. 
The engine was back up to nominal value In a short time, about 1 second. 
The following Is a list of the parameter descriptions and the figure numbers 

of the attached traces. 


PARAMETER DESCRIPTION FIGURE NUMBER 


Fuel Preburner Temperature 
Oxidizer Preburner Temperature 
Oxidizer Preburner Pressure 
Main Combustion Chamber Pressure 
HPOP Discharge Pressure 
HPFP Discharge Pressure 
FPOV Position 
OPOV Position 

Boost Pump Discharge Pressure 
Main Chamber Mixture Ratio 


1 LB/SEC 
12A 
12B 
12C 
1 2D 
12E 
12F 
12G 
12H 
121 
123 


5 LB/SEC 
12K 
12L 
12M 
12N 
120 
12P 
12Q 
12R 
12S 
12T 


A Table (Table 6.4.1) was compiled that shows the effect of each leakage 
flow (1 lb/sec. and 5 lb/sec) on each of the parameters studied. The effect 
Is defined as the percent change from nominal. 


6.4.2 HFFT DISCHARGE FLOW BLOCKAGE 


One such failure that Involves the HPFT discharge flow blockage, taken from 
FMEA files, was simulated with the DTM. The blockage was assumed to occur 
between the High Pressure Fuel Turbine and the Main Injector 
(see Figure 13A). The amount of blockage was Initially set to five times 
the resistance of the flow path. The engine power level was assumed to be 
104% prior to the failure. The failure was Initiated at 30.5 seconds, and 
the model was run from 29 to 39 seconds. The engine control system 
compensated for the blockage by changing the 0P0V and FPOV positions (see 
Figures 13M, 13N). The following Is a list of the parameter descriptions 
and the Figure numbers of the attached traces: 


PARAMETER DESCRIPTION 


FIGURE 


Fuel Preburner Temperature 

Oxidizer Preburner Temperature 

Fuel Preburner Pressure 

Oxidizer Preburner Pressure 

Main Combustion Chamber Pressure 

HPOP Discharge Pressure 

HPFP Discharge Pressure 

LPFP Speed 

HPFP Speed 

LPOP Speed 

HPOP Speed 

FPOV Position 

OPOV Position 

HPFT Discharge Temperature 
HPOT Discharge Temperature 
Main Chamber Mixture Ratio 
Main Chamber Temperature 


13B 

13C 

1 3D 

13E 

13F 

13G 

13H 

131 

130 

13K 

13L 

13M 

13N 

130 

13P 

13Q 

13R 
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6.5 


CLOSED-LOOP DTM - SAFD SIMULATIONS 


in order to demonstrate the operability of the failure detection algorithm 
the SAFD was combined with the DTM in such a way that the DTM output was 
used as inputs to the SAFD algorithm. Any anomalous behavior that effects 
some of the parameter values can thus be detected by the SAFD if these 
values are over the limits of the safety bands that are set for each of the 
parameters. For this purpose, the SAFD failure detection model was combined 
with the SSME transient model to form a closed-loop system model. The idea 
behind creating the closed-loop system model Is to be able to simulate any 
failures with the transient model and monitor the parameter signals for 
anomalous behavior with the SAFD algorithm on-line and real-time. 
Modifications to the code of both models were required for their 
combination. For example, subroutine SENSOR of the SAFD model, which reads 
In the SSME hot-fire test data from input files, has been eliminated as it 
has no purpose in the closed-loop model. The parameter signals generated by 
the transient simulation model subroutines will be available to the SAFD 
subroutines through common blocks and can, therefore, be monitored for 
anomalies with the SAFD algorithm. Table 6.5.1 correlates the transient 
model parameter variables with the SAFD parameter variables. 

6.5.1 CLOSED-LOOP LEAKAGE SIMULATION 

An artificial 5 lb/sec leakage of liquid oxidizer (LOX) was introduced 
downstream of the HPOTP preburner boost pump as a simulation of a FMEA 
external rupture (mentioned In the previous section). A non-zero start 
model run at 104% power level was made with a start time of 29 seconds. The 
leakage (failure) was initiated at 30 seconds, resulting In anomalous 
behavior of many parameters. The SAFD algorithm signalled a shutdown during 
the first two-second Interval, by Approach 1 at 30.10 seconds. Seven 
parameters registered exceedence of the safety band, thus signalling the 

cutoff. 

These parameters Include the HPOTP discharge pressure, the HPOTP boost pump 
discharge pressure, the main combustion chamber pressure, the HPOT discharge 
temperatures 1 and 2, the LPOTP pump discharge pressure, and the HPFTP 
discharge pressure. The results of the transient failure detection 
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simulation are presented In the plots of Figures 14A - 141. Each plot 
displays four signals which represent the parameter simulated signal, the 
signal average, the signal Approach 1 upper limit, and the signal Approach 1 

lower limit. 

Parameter Description 

HPOTP Discharge Pressure 
HPOTP Boost Pump Discharge Pressure 
Main Combustion Chamber Pressure 
HPFT Discharge Temperature 2 
HPOT Discharge Temperature 2 
LPOP Discharge Pressure 
HPFTP Discharge Pressure 
HPFTP Coolant Liner Pressure 
FPOV Actuator Position 

6.5.2 CLOSED LOOP BLOCKAGE SIMULATION 

A failure was simulated which involved Increasing the resistance (by a 
factor of two) of the duct between the HPFT and the main injector as a 
simulation of a FMEA HPFT discharge flow blockage (mentioned in the previous 
section). A non-zero start transient model run at 104X power level was 
made, with a start time of 29. seconds. The failure was implemented three 
seconds later at 32. seconds, resulting In rapidly occurring anomalies in 
many of the parameters. 

The SAFD algorithm signalled a shutdown with Approach 2 at 32.06 seconds due 
to detected anomalies In five parameters. Recall that Approach 1 Is In 
operation during the first two seconds of the algorithm operation, while 
Approach 2 Is In operation thereafter. The five parameters Include the HPFT 
discharge temperatures, the HPFTP discharge pressure, the FPOV actuator 
position, the HPFTP coolant liner pressure, and the fuel flowmeter. The 
results of the transient-failure detection simulation are presented in the 
plots of Figures 15A - 151. Each plot displays four signals which represent 
the parameter simulated signal, the signal average, the signal Approach 2 
upper limit, and the signal Approach 2 lower limit. The plots indicate 
clearly the engine steady-state behavior followed by anomalous behavior as a 
result of the blockage, and the subsequent recovery to steady-state due to 
the engine controller's command of the FPOV and OPOV actuator positions. 


Figure 

14A 

14B 

14C 

14D 

14E 

14F 

14G 

14H 

141 
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The SAFD algorithm detected an anomaly in the HPFT discharge temperature 
signal far earlier than the potential time of the redline temperature of 

1960*R. 


Parameter Description 


Figure 


Main Combustion Chamber Pressure 

High Pressure Fuel Turbopump Discharge Pressure 

High Pressure Fuel Turbopump Coolant Liner Pressure 

High Pressure Fuel Turbine Discharge Temp 1 

High Pressure Oxidizer Turbine Discharge Temp 1 

High Pressure Fuel Pump Speed 

Low Pressure Fuel Pump Speed 

Fuel Flowmeter 

FPOV Actuator Position 


15A 
15B 
15C 
15D 
1 5E 
15F 
156 
15H 
151 


6.6 LESSONS LEARNED 


During the course of the present contract, several features of the SSME were 
Investigated In detail and Information, useful for future failure detection 
algorithm development, was analyzed and recorded. Thus, transient effects 
other than the start and power transients, were found to significantly 
Influence parameter values. If these effects are not compensated for. the 
failure detection algorithm will lose some of Us sensitivity to failures 
and thus be more sluggish. Two of these effects are due to the 
repressurization and venting (of fuel and oxidizer) that are carried out 
during SSME ground tests to simulate actual flight conditions on the engine. 
These effects are apparent In over half of the 24 SAFO monitored 
parameters. Some of the effects of GOX and fuel repressurization valve 
closure are presented In Figure 16 and the effect of 

ventlng/repressurl zatlon are shown In Figure IT. Moreover, nonlinear 
behavior of several SSME parameters, that Is Inherent to engine 

characteristics, were also Identified. These effects were termed nonlinear 
because of the characteristic shape that each parameter takes In time even 
In the absence of any ventlng/repressurlzatlon or other transient 
phenomena. Thus, It takes over 75 seconds for the HPOT turbine discharge 
temperature, the MCC liner cavity pressure, and the HPOT seal cavity 
pressure to reach steady-state. While the HPOP Intermediate seal purge 
pressure Is totally nonlinear (see Figures IBA.B.C.O.E). If these 
parameters are to be monitored, then It Is necessary to develop estimates of 
their normal mean values that are piecewise linear or that are represented 
by predetermined curves that are close to the real parameter value such that 
the bandwidth placed around such a line can be made less restrictive. For, 
If the average (mean value) line can be closely represented then the safety 
band around It can be made smaller and thus provide an Increased sensitivity 

to the algorithm. 

in order to evaluate the possibility of a predetermined piecewise linear 
mean value profile for the parameters that are effected by the 

repressurization and venting procedures, the planned versus accomplished 
profile of the engine LOX Inlet net positive suction pressure (NPSP) were 
studied. It was found that the planned profile Is very closely traced by 
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the achieved profile (see Figure 19). Hence, it is possible to determine a 
piecewise linear average for the effected SAFD parameters by using a 
predetermined NPSP profile In combination with existing computational 
routines that calculate the "influence coefficients" that reflect the 
effects of a given degree of repressurlzation/ventlng on a given engine 
parameter. In this manner, the new piecewise linear average profiles for 

these parameters will be close representations of their actual values. This 
will lead to a more sensitive algorithm and thus catch failures in the early 

stages. 

These and other work can be carried out to enhance the SAFD performance and 
expand its scope significantly. 
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7. CONCLUSION 


Extensive computer simulations with the SAFD algorithm on real SSME Incident 
test data Indicate significantly earlier cutoffs than achieved with the 
existing redllne system. Cutoffs were found to be a function of the kind of 
failure that occurred, the speed with which It progressed and the location 
and degree of localization of the anomalies. Thus, In fast occurring 
failures, such as ruptures or breakage of structural areas, the SAFD showed 
only a slight gain over the redllnes. While for slow occurring failures the 
SAFD algorithm showed significantly earlier shutdown capability. 


The performance of the SAFD algorithm depends heavily on the choice of the 
weighting factor N that determines the bandwidth of the safety limits placed 
around the average value of each signal for monitoring purposes. Moreover, 
the added safety feature that the algorithm has Is the requirement for 
multiple anomalous signals for an engine cutoff command. Thus, three, four, 
five, six or more signals exceeding the safety limits simultaneously leads 
to a cutoff command. This number should be predetermined for each signal 
prior to each test. Hence, two factors are Important In the decision for 
engine cutoff. Namely, the weighting factor N and the number of anomalous 
parameters signalling failures simultaneously. There Is no procedure for 
the selection of these factors other than experience and trial and error 
presently. However, work has been performed on finding ways of 
automatically determining these numbers at the start of the algorithm during 

a test. 

The SAFD, as It currently stands, can only handle steady-state test 
operating conditions and It Is turned off during the start transient, as 
well as during power transients. However, the first Instant check that the 
algorithm Is equipped with (that Checks the value of each of the first 
incoming measurement signals against a precomputed nominal expected value) 
Is for detection of anomalous behavior that might have occurred during a 
transient. This feature provides some degree of fault detection capability 
at start or power transients. Moreover, the option of expanding the 
capability to handle transients, as well as other nonlinear and excursion 
effects are under consideration and plans for such augmentation exist. The 
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algorithm monitors more parameters than the redllnes, with the option of 
expanding the list even further. Also, the SAFO avoids -false alarms by 
the above mentioned requirement of the anomalous behavior of several 
parameters prior to a decision for engine shutdown. 

There are transient effects that effect several engine parameters due to 
repressurization and venting, as well as to GOX/fuel repressurization valve 
closures. These effects are presently compensated for by Increasing t e 
safety bandwidth to cover parameter excursions due to such transients, thus 
reducing the sensitivity of the algorithm to actual failures. However, 
plans to accommodate such behavior have been worked upon and can be 
implemented In follow-on work. Also lacking Is sensor failure detection 
(except for negative readings). These and other limitations of the SAFD can 
be worked on and Us effectiveness and scope can be enhanced given 
appropriate planning, analyses, simulations, and judicious approaches. 
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8. RECOMMENDATIONS 


By all means. It Is highly desirable to develop a failure Detect on 
algorithm for the SSHE that can operate under all conditions < st ” **! * * 
and transient) and that Is sensitive enough to detect and fast failures 
at such an early stage that damage to the engine Is minim ze . 
certain approaches that. If taken, can lead to the above ment oned enhan 
and expanded algorithm. In this section a few tasks are outlined that 
accomplish some of the enhancements. 


8.1 FAILURE DETECTION 

The fault detection problem Involves a thorough and realistic u " ders * and ’" 9 
and specification of the given system. The various failure modes that may 
occur can be described as either fast occurring and progressing or 
incipient (slow developing) faults. Fault detection Is approached e ther 
2 model-based or signal-based technics. For analytical redundancy 
purposes some kind of validation of nominal relationships 
system, using the actual Input and the measured output, are carried ou 
Te dynamics of the system are evaluated on-line In a real-time manner 

(Figure 20). 

Host advanced fault detection schemes suffer from complexity and often i from 
inherent weakness In reliability. However. It Is usually poss, 
develop simple fault detection schemes that do not require extensl 
analytical development and that work reliably and efficiently. Such 
approach involves the use of the SSME DTM. 

Analytical redundancy, especially when applied to key engine parameters, can 
provide significant reliability and enhanced performance, especla y un 
sensor failures. A good analytical model of the engine Is requ red the can 
predict the expected outputs very closely (to that of the actua values) an 
thus provide analytic, values to compare actual outputs with and make a 
decision regarding the status of the sensor. The SSHE OTM Is ve y 
effective tool that can be utilized (perhaps piecewise linearization will be 
required In order to make It real-time on-line applicable) or such 
analytical redundancy purposes. There are many key sensors that need 
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redundancy and that when Implemented can enhance engine performance, avoid 
engine shutdowns due to false alarms, and that can minimize damage from 

failures. 

8.2 SENSOR FAILURE DETECTION 

Throughout the history of the Space Shuttle program, the only SSME In-flight 
shutdown occurred during flight 51F July 30. 1985. due to the malfunction of 
the HPFT discharge temperature sensors. This type of failure can be easily 
avoided given a good (simple) sensor failure detection approach. 

Such an approach was evaluated using the Information from past engine data 
as well as simulations via the SSME OTM. It Is clearly Indicated In the 
sensor outputs from flight 51F (see Figure 21) that the only parameters that 
showed anomalous behavior were the two HPFT discharge temperature sensors, 
while all the other parameters were nominal. This Is sufficient cause to 
believe that It Is a sensor failure. Moreover, computer simulations by the 
OTM of the same sensor output (as was shown In Figure 21) was artlflcally 
Induced and the effects on other parameters were plotted. Figure 22 shows 
the dramatic Influence of a sudden temperature rise of the HPFT discharge 
flow on several other parameters. Since no such effects were recorded 
during flight 51F the "failure" was a false alarm. Similar Indications are 
shown In Figure 23. Herein, a change In any one of the parameters shown, 
results In a corresponding change In each of the other sensor outputs. 
Thus, sensor outputs can be correlated In such a manner as to generate 
useful Information regarding the status of sensors. 

The Implementation of such a scheme Is straight forward, does not require 
extensive computational effort and can significantly enhance the performance 

of the SAFD algorithm. 
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8.3 SAFO PERFORMANCE ENHANCEMENTS 


in accordance with the observations made In the previous pages. It Is highly 
recommended that work be continued on the SAFD algorithm development and 
enhancements directed towards expanding the capabilities of the algorithm 
These expansions should address SAFD operation during start and power 
transients, accommodations and compensations for nonlinear e ec s 
transient effects due to fuel/oxidizer repressurlzatlon/vent.ng and 
repressurization valve closures. In addition, sensor failure detection 
schemes should be simulated that are simple and easy to Implement In order 
to study their feasibility and effectiveness. 


The capability exists at Rocketdyne to evaluate the SSME from a systems 
point of view and develop failure detection schemes based on practice 
implementation and feasibility Issues and formulated on sound mathematics 
and advanced fault detection knowledge. Advanced observer-based estimation 
routines can be utilized, using the OTH. that can provide analytical 
redundancy and enhanced failure detection capability. Various options have 
already been studied and their feasibility has been evaluated. 


This useful effort should continue without the slow-down of unnecessary 
contractual breaks In order to have the engineers devote their full 
attention to the Important task of SSKE failure detection. 
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TABLE 6.1.2 MEAN VALUES AND STANDARD DEVIATIONS 


\ 

r.\ 


TIME - Hi*'** 
parameter TITLE 


1AFO SLICE TO SLICE 51®M E NGI NE 
^ CCNSIAT PROGRAM VERSION - 

TOTAL ENGINES - 1 TOTAL 

SIGMA EE 


MCC HG IMJ PN A 

HPfP CLNT L>« A 
HPFP CLNT LNR 8 
FP8 PC NED 
opb PC 

MCC ox inj m 
>+rp os PR NfO 
MCC PC a AVG (****) 

MCC PC B AVG (UCPB) 

MCC CLNT DS TWP 8 
HPFP SPEED A 
W*rp SPEED B 

f#rr os TIP a 

HPFT OS TV* B 
>#OT OS TLF A 
H»OT 05 TUP 8 
FAC OX FU OS PR 
DC OX IN PR 1 
ENG OX IN PR 2 
HPOP INLET PR A 
HPOP INLET PR B 
MX l NT PR 
NX INT T 
HX VENT DP 

OPOV ACT POS A (0PV2) 
OPOV ACT POS B (RVOB— I ) 
FPOV ACT POS A (FPV2) 
FPOV ACT POS B (RV06-2) 
ST PR A 


hpfp inlet 

HPFP INLET PR 
DC Ft IN PR I 
DC FL IN PR 2 
HPOP OS PR NFO 
PIP OS PR NFO 


TIME - 13:57:81 

JO | PARAMETER TITLE 

24 ) MCC HG INJ PR i 
S3 ) >*rP CLNT LNR A 
HPFP CLNT LNR B 
FP8 PC MFD 
OPB PC 

MCC OX INJ PP 
HPFP OS PP NFO 
MCC PC A AVG 
MCC PC B AVG 


(P1B) 


14 

3*41 

343? 

3121. 

52»4 

3721 

em. 

3127 

3123 

408 

35260 

35285 

174B 

187B 

1433 

1484 

88 

81 

81 

347 

347 

3871 

826 

83. 

87. 

87 

88 
88 

231 

231 

24 

24 

4115 

7535 


MEAN 

258*8# 
438888 
455888 
457888 
473888 
832088 
218088 
33288# 
712088 
482408 
.868088 
. 52888# 
.158888 

. 79280# 
.172088 
.557888 
.917140 
.682488 
.71 77 IB 
. 759808 
.884308 
634800 
•23488 
.551418 
.891488 
758598 
. 607880 
. 254528 
.840808 
. 122208 
.263370 
.321088 
777080 
695000 


STUDY (C02tt.iwa>l.) 

i*'"* 101*1. suets - 

SIGMA SL_ 

Aisvy. ^ 


DATE - 11/T8/B8 

a 

SIGMA SL £ {$3 1 


5.43*758 
5.038690 
5-662143 
5.555295 
5.367459 
B. 694274 
3.262973 
3.917472 

946.124888 

979.686888 

2.433852 
2 . 828767 
2.688828 
2.232572 
6.267596 
8.489688 
B. 495823 
1.261687 
1.227915 
2.645874 
6582979 
8.844872 
8. 135297 
8.939824 
9. 164756 
8.146984 
1.888288 
1 . 172412 
9.125191 
8.129539 
4.71 7856 
6.713989 


1 

782 


94661* 

584976 

999374 

673335 

.245941 

.139229 

.289927 

.972988 

.817681 

.823788 

731788 

829828 

316879 

553868 

678632 

175156 

269998 

.274849 

298649 

396849 

431776 

419862 

183112 

187869 

853653 

168132 

118937 

112854 

112612 

889117 

069953 

625375 

956991 


iiNAL PAGE IS 
OF POOR QUALITY 


SAID SLICE TO 
TOTAL ENGINES 


SLICE 5IGUA ENGINE VA* I ATI ON STUDY (EJM.»Wll (SLMM] 
GtNSIAT program VERSION - 1.8T 


TOTAL PUNS 


HPFP SPEED A 

hpfp speed b 

HPFT 05 TIP A 
HPf T OS TIP* B 
HPOT OS TMP A 
HPOT OS TIT 8 
FAC OX Fll OS PR 350 PSI5 
DC OX IN PR 1 258 PStS 

DC OX IN PR 2 250 PS IS 

LPOP 0I5CMG PR A 
LPOP OISCHC PR 8 
HX INT PP 5K PSI5 

KX INT T 188/1908 

KX VENT OP 258PSID 

OPOV ACT POS A (0PV2) 
OPOV ACT POS 0 (RV08-1) 
FPOV ACT POS A (FPV2 ) 
FPOV ACT POS 8 (RV06-2) 
LPFP OISCHC PP A 
LPFP OISCHC PR 8 (Pit) 
DC n. IN PR 1 188 PSI 

DC FL IN PR 2 188 PSI 

05 PR M^O 7K PSIA 
POP OS PR NFO 9588 PSI 



WEAN 

SIGMA 


1 4 . 236000 

- 

l 

3410. 638608 

” 

1 

3429 295088 

— 

7K PSIA 

5155.398868 

” 

18K PSIS 

5249.523088 


5K PSIS 

3764.240868 

* 

9588 PSI 

6137.223086 

“ 

(UCPA) 

3125.968060 

* 

(MCP9) 

3125-272188 


P 8 

417 669960 

* 


34988 886060 

“ 


35905.366080 

“ 


1749.575068 

• 


1726.712068 

- 


1462 662800 

” 


1484.495000 

* 


^ ri " . 

TOTAL SLICES - 188 % ft Vi 

flOT* sfeu» SLp 


It 


SIGMA SL 


$1.628538 
81.796658 
62 
334 
334 
3372 
925 
124 


67 

79 

79 

226 

226 

24 

24 

4872 

7498 


.862500 

.375080 

.208888 

721780 

.796700 

363120 

.596010 

503910 

.592416 

.463188 

.37538# 

145138 

136630 

439808 

227888 


5.345685 
S. 727666 
4 . 988962 
6.856659 
5.884245 
8.367543 
3.724154 
4.132822 

.mihh- 

353.229788 

389. 471980 
1.984482 
2.227765 
1.942775 
1.656885 
8.266388 
6.577686 
8.581692 
1.229636 
1.264786 
2.666518 
8.241222 
8.869781 
§ . 995357 
8.966197 
9.196356 
8.186749 
9. 682899 
•694543 
8.152457 
8.144548 
4.116656 
12.559358 


42 

43 


C/l 


,Y* 


561666 
144383 
217896 
935469 
.22732* 
.616986 
.145163 
.969623 
. 457292 
518688 
628888 
118579 
486753 
.899836 
.872664 
. 167488 
.333462 
.333546 
.276789 
.273836 
.846346 
.341649 
.888285 
. 137290 
888849 
.134631 
138924 
912489 
697852 
128894 
116416 
.781718 
. 463238 


TIME - 88:36:48 


IQ | PARAMETER TITLE 


SAID SLICE TO 
TOTAL ENGINES 


SLICE SICA4A ENGINE VARIATION STUDY (F2029. 16***t) [SL282»Aj 
GENSTAT PROGRAM VERSION - 1 av 

I TOTAL RUNS 

fir 4 

5 1 CM* SL I 


11 Vf 


MCC MG INJ PR A 
H>FP CLNT LNR A 
l#FP CLNT LNR 8 
FPB PC MFD 7K PSIA 

OPB PC 18* PSI* 

MCC OX INJ PR 5K PSIS 
HPFP OS PR NFO 9588 PSI 
MCC PC A AVG (ICPA) 

MCC PC 8 *VG (MCP8) 

MCC CLNT OS W 8 
tWTP SPEED A 
»FP SPEED 8 
HR FT OS IMP A 
HPFT OS TLF 8 
►8*0 T OS TI8» A 
I POT OS TVP 8 
FAC OX FM OS PR 358 PSIS 
DC OX IN N I 256 PSIS 
CNC OX IN PR 2 258 PSIS 

LPOP 01 sac PR A 
LPOP OISCHC PR 8 
KX INT PR 5A PSIS 

MX INT T 168/1988 

HX VENT OP 258PSI0 

OPOV ACT POS A (0PV2) 
OPOV ACT POS 8 (RVOB-1) 
FPOV ACT POS A (FPV2) 
FPOV ACT POS 0 (RV08-2) 

lpfp oisae pr a 

LPFP DI5CHG PR B (Pl8) 
CNC FL IN PR 1 188 PSI 

DC FL IN PR 2 188 PSI 

HPOP OS PR NFO 7K PSIA 
P0P OS PR MFD 9586 P$1 


3356 

3415 

3416 
5146 
5165 
3698. 
6125 
3126 
3124 

469 

35925 

35618 

1618 

1651 

1317 

1369 

86 

82. 

82 

357. 

358. 

3757 

853 

68 

67 

67 

79 

79 

246 

246 

7 

7 

4655 

7228 


MEAN 

155088 
870880 
165888 
.625088 
.687088 
. 769880 
.370800 


16*000 

875008 

200080 

528008 

782880 

850000 

.545080 

.638000 

545620 

.316730 

743368 

.519308 

.401900 

.926880 

469708 

714668 

356788 

467108 

765468 

789840 

.781688 

.932888 

561940 

.579253 

.174808 

701008 


7.317475 
7.187749 
6.757648 
6.237468 
18.263899 
6.964663 
14.172988 
4.899556 
3.375366 
1.631679 
513.465689 
476.686588 
8.566335 
8.566847 
3.447558 
1.656313 
8.536363 
6.741617 
6.745618 
1 .563489 
1.543244 
4.168829 
•231179 
9.867234 
8.127735 
8. 155459 
9.131197 
9. 198749 
». 895974 
1.882997 
8.142897 
9.146422 
6.743131 
15.272738 


FIB 


7.236272 

5.612542 

5.825751 

5.994517 

5.331517 

5.383572 

7.443789 

3.586327 

3.641812 


SLICES - 18 


SIOM SL 


852156 

616136 

466413 

.736395 

.977136 

.794762 

.067858 

771986 

894482 


384.861888 

384.515188 

2.887671 

2244894 

2.933932 

1.981887 

6.338884 

8.278328 

8.279374 

1.244213 

1.422423 

3.295287 

4.727888 

8.117985 

8.127735 

•895357 

9.129518 

6.128195 

1.481888 

1.388676 

8.288127 

8.211848 

4.851521 

8.843372 


358 

347 

2 . 

3 

2 

• 

6 

• 

1 

1 

3 

• 

8. 

8 

6 

6 

6 

I 

1 

i 

• 

5 

8 


175888 

•88188 

,799813 

726272 

.531569 

.975384 

.348882 

.415433 

.581382 

.384848 

.441057 

294552 

487955 

•43197 

.675621 

.638474 
.128195 
. 136415 
.383936 
.297356 
.221785 
.225189 
•63859 
158652 


(E2929 . 169*PL) 

SIGMA $L 

6.494752 
5.514937 
5.786129 
7.159874 
4.626337 
3.975 »§7 
6.229546 
3.777332 
4 629324 
9 .895559 
495 898289 
499 998288 
5.768597 
8.277939 
3.854462 
1.933986 
8.186672 
•382782 
8.381758 
1.889 786 
1.622341 
3.126815 
6 526641 
9.852641 
9.136182 
9 125936 
9156331 
6.166716 
1.593524 
1.648297 
9. 179993 
6.181328 
4.481832 
7.166798 





TABLE 6.1.2 (cont.) 


10 | 

2 « 
U 
S4 
419 
4M 
399 
499 
2N 
291 
19 
2M 
291 

231 

232 

233 

234 
•94 
131 
999 
299 
219 
979 
979 
993 
149 

141 

142 

143 

293 

294 
921 
919 
334 
341 


TIME - 99:43:99 
PAJLMCTCa TITLE 


SATO SLICE TO SLICE SICUA DC INC VAN I AT I ON 
CCMSTAT RROCRAU VERSION - 
TOTAL ENGINES - 1 TOTAL m*S - 

J* tyrt. 


UCAN 


CSIOUA }L 


STUDY (C2197, 1949FL) 

’"tK-l’VR 

g SIGMA SL 


ISU197A1 

- - /? lift 

A SIQ4A SL 


/ fo - I b S S*^ ' 

J Vf 


~&VYSX, 


7K RSIA 
19K RSIS 
9K RSIS 

9999 RSI 

(UCPA) 

■ ) 


UCC HG IHJ PR A 
►PFP CLHT LNR A 
►PFR Cl NT Om 9 

TR9 RC MTO 
OP® RC 

MCC OX INJ RR 
►PFR DS RR NFD 
UCC RC A AVG 
UCC RC 9 Avc 
UCC CLNT OS TIP 9 
►PFR SPEED A 
►pfr SPEED 0 
HRfT OS TUP A 
HR FT OS TIP 8 
►POT OS TIP A 
HPOT OS TIP 9 
FAC OX ru OS RR 399 RSIS 
ENG OX IN PR 1 299 PSI5 

INC OX 1H PR 2 
LPOR OISCHG PR 
LPOP OISCHG PR 
HX INT PR 
HX INT T 
HX VENT OP 
OPOV ACT ROS A 
OROV ACT ROS B (RVOB-t 
FROV ACT ROS A (FPV2) 
FROV ACT ROS B (RVDB-2) 
LRFR OISCHG RR A 
LRFR OISCHG PR 9 (Pi®) 

ENG FL IN PR 1 199 PS I 

ENG FL IN RR 2 199 RSI 

HPOR OS PR MFD 7K PSIA 
POP OS RR MTO 9999 RSI 


TIME - 99:99:11 


299 RSIS 

A 

9 

5K RSIS 
199/1999 
259RSI0 
(ORva) 


3345.189999 

7.423975 

7.483922 

3428.980909 

7.993177 

5.719198 

3425.999999 

4.824998 

4.713237 

5998 141999 

4.229946 

5.885562 

5199.928999 

8.965984 

9.348997 

3946.339998 

7.242997 

5.398935 

8131523098 

7.595149 

7.552399 

3134.217999 

4.685589 

4.939527 

3118.284999 

3.919917 

3.441959 

469.855999 

8.924919 

1.998119 

35159.489999 

494. 231 799 

475.119299 

35152.72999# 

489.952969 

493.995269 

1657.457999 

3.288183 

4.448149 

1696.375999 

3.758969 

4.999943 

1343979999 

2.995766 

2.719297 

1349.885899 

I 81422* 

2.899744 

81 .399799 

9.297536 

9.414984 

82.251919 

9.435556 

9.549971 

82.463279 

8. 4465 48 

9.554336 

349.991199 

1.164829 

1.119159 

341 .949399 

1.948548 

1.175853 

3899778999 

3.142138 

2.952339 

875.299199 

9. 182974 

1 .995441 

•2.126758 

9.935933 

8.977973 

86.518919 

9. 135316 

9.139451 

66.967969 

9.974935 

9.999276 

89.549999 

6. 13531# 

9.149953 

89.918949 

• 192799 

9.144232 

224.636499 

9.939334 

1.911349 

226.987869 

9.919929 

9.998797 

24.349246 

8.969152 

9.139297 

24.289959 

8.975478 

9.136419 

4139.766969 

4.595365 

5.397259 

7215.783969 

19.227958 

19.793899 


7.494489 
9.577443 
4.799491 
9-992913 
7.999517 
9.389993 
9.774783 
4.999819 
3.427774 
9.917912 
474.737199 
497.921999 
2.993994 
3.223923 
3. 199397 
2.787797 
9.389499 
9-477128 
9.482259 
1.241492 
1.392217 
2.737889 
9.335734 
9.948379 
9.136915 
9.999989 
9.138823 
« . 1 38323 
8.947861 
8.937529 
9.118182 
9.122831 
5.748299 
11.759799 


SlOJA SL 

7.395499 

5.989579 

4.571954 

4.734979 

8.939944 

8.749214 

7.812994 

4.127852 

3.878489 

9.895554 

593.199799 

494.114599 

2.9439(7 

3 495932 
2.944332 
1 .995539 
9.357436 
9.594644 
9.513972 
1.234539 
1 . 196528 
2.939332 
9. 185124 
9.841 196 
• 133391 
9 933633 
9.137296 
9.116496 
9.877794 
6.878274 
9.118999 
9. 125394 
4.751739 
18. 618616 


SATO SLICE TO SLICE SIGMA ENGINE VARIATION STUDY (E2196) [SL2196A] 
GEN$ FAT PROGRAM VERSION 1 .9X 
TOTAL ENGINES - I TOTAL RUMS - 1 TOTAL SI.' 




0> 


ORIGINAL PAGE IS j 
POOR QUALITY j 


0 


10 # 

parameter title 


UCAN 

W«. & 


T 

SIGMA i 

24 

) UCC MG TNJ PR A 


3358 946669 

La*?' 

7 . 883996 

7.899937 

53 

) MPFR CLNT LHP A 


3426.916866 

5.829999 

5.999544 

5.166119 

54 

HPFR CLNT LNR B 


3421.515666 

8.959929 

5.429293 

5.947669 

419 

FPB PC NFO 


4928652666 

8.481238 

6.283927 

3.955791 

469 

0P9 PC 


5228.395666 

7.969857 

6.915764 

7.965469 

395 

UCC OX INJ RR 


3891.271066 

7 252992 

5.493994 

5.562891 

459 

HRFP OS PR NFO 


8163.512666 

9929118 

8.787118 

7.985141 

299 

) UCC RC A AUG 

(UCPA) 

3126.757606 

4.469788 

3.913059 

4.161818 

291 

> UCC PC B AVC 

(WC P8) 

3125.325666 

3.846486 

3.619827 

3.991468 

18 

) UCC CLNT OS TIP 8 

449 . 756666 

•.•99969 

•.999999 

9 996699 

299 

►PFR SPEED A 


35126. 166666 

124.859296 

219.136899 

215. 999966 

291 

►PFR SPEED 8 


35132.286666 

139.249899 

212.962599 

215.913296 

231 

►PFT OS nPA 


1873.925966 

2.199529 

2.599777 

2.747358 

232 

1PFT DS TUP 8 


(749.438969 

3.181797 

2.599991 

2.367879 

233 

►POT OS TIP A 


1354 149969 

3.595733 

3.297639 

3.297979 

234 

►POT DS TIP 8 


1432.285969 

2.128929 

2.254793 

2.755568 

954 

FAC OX FU OS PR 


81 924959 

9.394292 

9.323566 

9.321545 

858 

ENG OX IN PR 1 


91.467389 

9.459172 

9.288527 

9 332449 

isi ; 

ENC OX IN PR 2 


61.397519 

9.477773 

9.291395 

9.333433 

299 

LPOR OISCHG PR A 


349.558899 

1.221949 

1.139924 

1.968753 

219 

LPOP 01 SCHC RR ® 


341.884869 

1 . 199469 

1.186969 

6.989424 

878 

HX INT PR 


3358 . 838999 

3.994152 

3.692988 

3.749798 

979 : 

HX INT T 


969. 198069 

9.215951 

1.419369 

1.457213 

993 : 

HX VENT OR 


125.327466 

9.155427 

9. 192556 

9. 139218 

146 ) 

OPOV ACT ROS A 

(0RV2) 

95.249219 

9. 192199 

9.135712 

6. 139415 

141 

i OROV ACT ROS • (RVO®-l) 

94 885799 

9.139371 

6.654484 

9.996197 

142 j 

FROV ACT ROS A 

( FRV2) 

79 886099 

9. 144271 

9.118945 

• 123113 

143 

FROV ACT ROS 9 (RVDB-2) 

79 983359 

9. 155189 

■127993 

9. 135265 

293 ) 

LRFR OISCHG RR A 


257.877969 

1 .899218 

1.937499 

6.978936 

294 

LRFR OISCHG RR B 

(RIB) 

257 . 882399 

1 . 189797 

1.991759 

1.998899 

■21 ) 

ENC FL IN PR 1 


25.139949 

8. 156753 

9.159225 

9.166552 

919 J 

ENC FL IN RR 2 


24 947988 

9. 152924 

8. 155143 

9.173299 

334 ) 

►POP OS RR NPO 


4973.838699 

5.893695 

5.739129 

8.573155 

341 ) 

R8R OS PR MFD 


7499. 121999 

13.493949 

11.59341# 

13.293729 


i/cf 




SAFO SLICE TO SLICE SIGMA CHOI ME VARIATION 
TIME - 99:19:19 CENSTAF PROGRAM VERSION - 

TOTAL ENGINES - 1 IOIAL RUNS 


STUDY M Yi-n.HMTW) {SL2929J 

1.0V 

I ioiai SHOES - 
(E2927 , 194XRL) 




ID 1 

PARAMETER TITLE 


MEAN 

SIGMA EE 

- SIGMA SL 

#197? / 

24 1 

UCC HO INJ RR A 

► 

3393.885060 

- 

V. 236272 

53 

MRFR CLNT UP A 


3455.445600 

- 

5.345885 

54 

►PFR CLNT UP 1 

1 

3441 . 155060 

— 

5.427991 

419 

FRB RC MFD 

7K RSIA 

5176. T9 7069 

- 

5.859511 

499 

ORB RC 

1BK PSIS 

5183.879606 

— 

8.438751 

395 

UCC OX INJ RR 

5K RSIS 

3859.914006 

— 

8.919977 

459 

HPFP OS PR NFO 

959# RSI 

6219. 105966 

— 

19.932519 

299 

UCC RC A AVC 

(MCPA) 

3126.515006 

— 

3.137792 

291 

UCC PC 8 AVC 

(MCPB) 

3126.306000 

- 

3.27178# 

19 

1 UCC CLNT OS TIP 8 

493.524060 

- 

9. 966666 

299 

> HRfR SPEED A 


35369.740009 

- 

359.257190 

291 

> HRfR SPEED I 


35358 . 520000 

- 

339.614799 

231 

| HRFT OS TIP A 


1842. 662006 

— 

5.734857 

232 

\ HRFT DS TIP 8 


1652.882006 

- 

4.772985 

233 

) ►POT OS TIP A 


1215.467600 

- 

1.947399 

234 

| ►POT DS TIP 8 


1242. 145660 

— 

1 . 498229 

854 

| FAC OX FU OS PR 

359 RSIS 

— srrnrnr 

- 

9.397929 

959 

} ENG OX IN RR 1 

25# RSIS 

82.91 I7H0 

- 

8.589472 

859 

) ENC OX IN RR 2 

259 PSIS 

02.9363)0 

— 

9.597931 

269 

} LPOR OISCHG RR 

A 

339.997300 

— 

1 .341939 

219 

) LPOR OISCHG PR 

8 

338.414300 

— 

1.41 9582 

979 

) HX INT RR 

5K R5I5 

3741 .874066 

— 

2.379599 

979 

> MX IMF T 

169/1969 

•22.794760 

- 

9.484291 

993 

) HX VENT DP 

256RSID 

96.727480 

— 

9.946253 

149 

\ OPOV ACT POS A 

(0RV2) 

84.694069 

- 

6.11 8946 

141 

) OPOV ACT POS 8 

(RvoB-n 

83.781179 

- 

9 . 979647 

142 

) FROV ACT POS A 

(FRV2) 

79.536716 

- 

9. 13191 1 

143 

) FROV ACT ROS 9 

(RV08-2) 

78.739146 

- 

9. 148944 

293 

( LPFR OISCHG RR 

A 

231.779460 

— 

1 .985735 

294 

) LPFR OISCHG PR 

8 (R18) 

231.521608 

- 

1 .996547 

821 

ENC FL IN PR 1 

196 PSI 

6.249372 

— 

9. 199864 

819 

) ENC FL IN RR 2 

199 R5I 

6.317539 

- 

9. 193914 

334 

) tPOR DS RR NFO 

7K RSIA 

4926. 423608 

— 

3.31 7938 

34i ; 

) RBR OS PR NfD 

9566 PSI 

722t. 527668 

- 

9.959897 


a un 

S.CUISL _ y% 


3.318219 
9.941922 
3.374311 
4.391119 
4.919191 
4.598132 
7.128549 
3.736539 
2.783397 
1 .991735 
344.598499 
349.559599 
3.343299 
2.219325 
1 . 794994 
1 .399395 
8.299724 
9.491497 
9.411942 
1.994942 
1.914277 
1.457339 
9.393461 
9.925199 
9.126393 
9.064333 
9.137299 
9.147371 
1.257419 
1.1 99392 
9.154339 
9.169914 
4.219992 
5.988748 


tSV' 




TIME - 12:54:45 


► | PARAMETER TITLE 


TABLE 6.1.2A (cont.) 

pgiRIMi AMCC PWS AVC VALUE * SIGMA CMC TO ENG (1*4* PL) PRCD VS ACTUAL 

DATA nw A2 TEST STAW-TESTS 9424399 TO 9*2*415 
(■ITW ONE PU#> CHANGE) 

CENSTAT PROGRAM VCTSIW - 


TOTAL ENGINES - 1 

MEAN 


TOTAL 


^ - 1 TOTAL SLICES - • _ 

* ,a *l 

C5JMIH 3.535534 


5 

S 

7 

a 

a ) 

ia ) 
n i 
12 ) 
is ) 
u ) 

15 

It 

IT 

IS 

19 

29 

21 

22 

23 

24 

25 

25 ) 

27 

29 

29 

39 

31 

32 


IMF70TAP 

HPPTDTAA 

**FTDTBP 

WTDTBA 

oiotdta 

o**ftdti 

hpototap 

HPOTDTAA 

MPOTOTBP 

HPOTOTBA 

owotota 

OHPOTOT8 

LPOPSPPR 

LPOPSPA 

ifOASPra 

I^OPSPA 

lpfpsppr 

lpfpspa 

hpfpsppr 

>#FP5PA 

OLPOPSP 

OK»OPSP 

olpfpsp 

OHPFPSP 

OPOVPR 

OPOVA 

FPOVPR 

FPOVA 

OOPOV 

OFPOV 


To-rai 


.339999 


•4.933339 


15. 499129 

41 ! 599399 
52.991499 

29.414559 

24.534139 

59.967579 

41.199914 

59.979499 

39549559 

32.774499 

22.394799 

27.325299 
15.955459 
216.441499 
221. 421499 
524.472999 
453.715399 
75.911999 
195.199299 
19.999999 
24.579899 
85.945199 
45.144379 

9.949835 

9.399949 

1.931992 
1 .314294 
9.451644 
9.341939 


1952 . 

1975. 

1732 . 

1742.3 

22.599999 

19. 


1327. 

1337. 

1417. 

1497. 

19. 

59. 

5229. 

5299. 

28475. 

25595. 

18169. 

19145 

35175 

35149 

29 

39 

5 

15 


95.349999 

45.459999 


84.349999 
4. ’ 99999 
9.499999 


3.535534 

6.999999 

17.477479 

14.999999 

3.535534 

7.471999 

3.535534 

17.477474 

39.999879 

31.819814 

14.142149 

14.142144 

14.142149 

14.142149 

164.994999 

134.359399 

28.294274 

21-213214 

35.355339 

54.598549 

4.444444 

28.284279 

7.471449 

21.213219 

4.494973 

9.353553 

9.074715 

6.436493 

4.141421 

6.424264 


1473.125994 

1474.259999 

1754.375999 
1744.975999 
11.675999 
14.i 


1345.* 
1354.675999 
1495.625999 
1421.259999 

14.679999 

24.375999 


5215. 

5217 

26536. 

28344 

162*2 

14213 

35274 

35243 

1 

44 

16 

17 


625999 

599999 

259996 


75*999 

256999 


8759*9 

2599*9 

2599*4 


45.75999* 

45 . 762544 

61.642594 

69.712496 

9.337569 

6.599949 


POtroiawNCE w<®« *« vauk * sicua we to chc ('•»* «.) <*n> v s actual 


BATA n«l A1 TOT STAMO-TQT NIMH TO MINI) 
WITH MO PVAS* CHANGES 




TIME - 15:29:18 


to § parameter title 

3 ) HPFTOTAP 

4 ) **ftotaa 

5 ) HP FT OT BP 
* HPFTOTBA 

OHPFTOTA 
OHPFTOTB 


total ENGINES - 


CENSTAT PROGRAM VERSION - 890 


3 I 

i! 


9 ) HPOTOTAP 
t# ) HPOTDTAA 

11 ) HPOTDTBP 

12 ) 19*0TDTBA 

13 ) OMPOTDTA 

14 ) WM0TDT8 

15 ) LPOPSPPP 

16 ) LPOPSPA 

17 ) HPOPSPPR 

18 ) HPOPSPA 
18 ) LPFPSPPR 
29 ) LPTPSPA 

21 ) HPFPSPPR 

22 ) HPFP5PA 

23 ) OLPOPSP 

24 ) OHPOPSP 

25 ) OLPFPSP 
29 ) OHPFPSP 

27 ) OPOVPR 

28 ) OPOVA 

29 ) FPOvPR 
39 ) FPOVA 
3! ) OOPOV 
32 ) DFPOV 


MEAN 

1632.983699 

1655.633*99 

1683.759996 

1695833666 

19563336 

17.916469 

1389593999 

1342.598999 

1433.333999 

1437.983999 

7.916464 

17.993334 

5224.194999 

5224.144999 

28443.339999 
28442.599999 

15842.919999 

15952.919999 

35493.339999 
35399999999 

4. ti 


27.! 
39.833339 
35. 849849 

47.593339 

47.441499 

79.759999 

79.933339 

4.141447 

9. 


TOTAL RUNS 

SICUA EE 

34.341759 
35.421649 
44.346519 
44.442639 
13.392399 
14.841336 


•2.174919 
63 . 478799 
66.934899 
69.981919 
7.216978 
16.169879 

13.719549 

15.539729 

397.112399 

392.441299 

43.992149 

47.742999 

344.874399 

349.555299 

4.497184 

31.152119 

38.954139 

23.494349 

1 .918793 
9.967887 
1.534993 
1.439579 
9.398934 
9.579937 




TOTAL SLICES - 12 

-rflfA .A- 

“CAN ^ 

1437.5 
1647 


SIQ4A 


29. 999999 


1495 

1442 

45 

67.51 

3225 . 

3213. 

28799. 

29399. 

15993. 

13943. 

33319. 

33215. 

39. 

114. 

199. 

95. 

47. 

•7. 

79. 

74 

9. 

2 


3.535534 
31 .919819 

•994994 

28.294279 

14.142149 

4. 


•3.439499 

28.284279 

43.639499 

31 .819814 
21.213219 
31.81981* 

21.21321* 
21.213219 
141.421499 
579 827499 
77.78175* 
149.462499 
155.563599 
46. 467489 
14.142149 
94.852819 
84.952819 
196.966999 

4.7*71*7 
9.424269 
2. 121321 
1 .767767 
• 282843 
6 353553 


PERFORMANCE PAMS AVC VALUE 8 5IGMA DC TO ENG (189ft PL) FRED VS ACTUAL 
(ENGINE TO ENGINE PREDICTIONS) 


TIME - 11:14: 


ID § PARAMETER TITLE 


TOTAL engines - 


HPFTOTAP 
MPTTDTAA 
►PFTOTBP 
HPFTOTBA 
OHPFTOTA 
OfrPFTDTB 
. HPOTOTAP 
t*OTOTAA 
1*0TDTBP 
►MOTOTBA 
O^OTDTA 
pHPOTDTB 
LP0P5PPR 
LPOPSPA 
1P0PSPPR 
HPOPSPA 
LPFPSPPR 
LPFPSPA 

i^h»sppr 

1MFPSPA M , 

dlpopsp — nr - h 4 
01#OPSP 


CENSTAT PROGRAM VERSION - 
5 TOTAL runs 

MEAN SIGMA EE 

MM 59.995199 

9999 45.221599 


TOTAL SLICES - 


OLPFPSP 
OLPFPSP 

27 ). OPOVPR 

28 ) OPOVA 

29 ) ( FPOVPR 
39 ) i FPOVA 

31 ) OOPOV 

32 1 OrPOV 


84.299*99 
C7^2. 499999 
J f i leeeee 


38. 6551 16 
39.794339 
26.7B9199 
98.792249 
139.211499 
61.973739 
118.459299 
•3.16452* 
•2.843959 
27.749979 
91.679974 
329.933599 
321.325449 
59*1855*9 
352.66149* 
M4. 417599 
299 . 944999 
* 59.749499 
392.284499 
294.142894 
233.516499 
1.943167 
2.142174 
9.696699 
2.618662 
1.294219 


SUCFi 8 

19.629239 
22.166136 
22 . 199716 
22 . 19632# 
19.669559 
5.345224 

39.55196# 

39.164696 

44.962699 

43.73213* 

14.469559 

29.77739# 

18.615379 

17.72819* 

103.9962*6 

199.714196 

55.979426 

65.23369* 
194.73619# 
161 831466 
3.726H9 
33.779746 
11 .677356 
18.322516 

6.963624 
• 699364 
1.425226 
1.536639 
6.346152 
6.366456 


PAGE IS 

OF FuOR QUALITY 


TABLE 6.1.3 


PRELIMINARY CHOICE OF TESTS 'OR SAFD SIMULATIONS 
TEST # REASON FOR 

901-173 RE-RUN OF TESTS FROM SAFD PHASE 2 

901-225 RE-RUN OF TESTS FROM SAFD PHASE 2 

901-285 RE-RUN OF TESTS FROM SAFD PHASE 2 

901-340 RE-RUN OF TESTS FROM SAFD PHASE 2 

901-364 RE-RUN OF TESTS FROM SAFD PHASE 2 

750-285 ONLY FEEDLINE FAILURE 

901- 485 ONLY NOZZLE TUBE FAILURE 

750-259 ONLY MCC NECK FAILURE 

750-175 OXIDIZER DUCT FAILURE 

902- 471 FUEL DUCT FAILURE 

' 902-428 OPB INJECTOR FAILURE 

901- 307 FPB INJECTOR FAILURE 

902- 249 TURBINE BLADE FAILURE (HPFTP) 

901-436 COOLANT LINER BUCKLE (HPFTP) 

901-136 BEARING FAILURE (HPOTP) 

904-044 BEARING FAILURE (HPOTP) 

SF6-01 MAIN FUEL VALVE FAILURE 


- 58 - 





TABLE 6.1.5 DATA S' 'ERSION ROUTINE 




- 60 - 


GRiGINAL PAGE IS 
OF POOR QUALITY 






IT START - . 1068E+04 



ORIGINAL PAGE IS 
OF POOR QUALITY 



SSME Real-Time Failure Control Algorithm 

Original SAFD Monitored Parameters (Phase I & II) 





- 63 - 



SSME Real-Time Failure Control Algorithm 

Current SAFD Monitored Parameters 




- 64 - 



TABL 



ORIGINAL PAGE IE 
OF POOR QUALITY 


COMMANDED M? 


















































































































































































































TABLE 6.1.9 

LOX Venting Effects on Engine Parameters 


TIME - 1 t :25: !■ 


ID § PARAMETER TITLE 


SAED SLICE TO SLICE SIGN* VARIATION STLDY 
TEST 9626479, 129-174 SEC 
CEWSTAT PROGRAM VERSION 
TOTAL ENGINES - 1 TOTAL RWS 


(E2266,194%PL) [5L479ST] 


1 .BYo 

1 TOTAL 


SLICES - 2586 


24 ) 

53 ) 

54 ' 
410 


3*5 

! 459 ) 

( 286 * 
( 2§1 
( t® 4 
( 268 ) 
( 291 * 

< 231 

( 232 

( 

234 
( 554 

( 555 

( 559 

{ 259 

( 215 
{ 575 
( 879 

( 683 

( 145 

( Ml 

< 

( 143 

( 293 

( 254 

( 521 

819 
334 
341 


MCC HC INJ PR A 
HPFP CLNT LNR A 
HPFP CLNT \J* 8 
FPB PC NFO 
OPB PC 

MCC OX INJ PR 
HPFP OS PR NFO 
MCC PC A AVG 
MCC PC B AVG 
MCC CLNT 05 Ttf* 
t+fP SPEED A 
HPFP SPEED B 
Hprr os tv# 5 a 

HP FT 05 TW» B 
►#*0T OS W A 
HPOT 05 TVP 8 
FAC OX FM 05 PR 359 PSIS 
ENC OX IN PR 1 259 PSIS 

ENG OX IN PR 2 
LPOP OISCHG PR 
LPOP DISCHC PR 
HX 1MT PR 
HX 1NT T 
HX VENT DP 
OPOV ACT P05 A 
OPOV ACT POS • (RVO0-1) 
FPOV ACT POS A (FPV2) 
FPOV ACT POS 8 (RVD5-2) 
LPFP OISCHG PR A 
LPFP OISCHG PR B (P1B) 
ENG FL IN PR 1 199 P5I 

ENG FL IN PR 2 199 PSI 

IPOP OS PR NFO 
P0P OS PR NFO 


7K PSIA 
16K PSIS 
5K P5I5 
9599 PSI 
(MCPA) 

(UCPB) 

B 


259 PSIS 

A 

B 

5K PSIS 
189/1999 

259PS1D 

(0PV2) 


7K PSIA 
9599 PSI 


MEAN 

W/0 

3358.536999 
3418.478999 
3429 993999 
5228 439999 
5199 885999 
3689 . 458999 
6239 496999 
3129.459966 
3123.417699 
419.569696 
35671 . 466966 
35672389969 
1743.885999 
1783.342999 
1213.262999 
1225.6316W 
88128956 
81.769876 
81 .894156 
355.929469 
356.633396 
3361394996 
798.222266 
128.795496 
66.762966 
66.152199 
84.796469 
84.388149 
242.293196 
242.375699 
23.446918 
23.474418 
4848.916898 
7281.641999 


SIGMA SL 

MEAN 


SIGUt I 

V£tJT 
7 424268 

W 1 T M 

4.0X 


3361.184999 


7 . 932869 

6.122985 

3419.583898 


6.289888 

5.847653 

3422.872999 


5.686497 

8.563354 

5199.328999 


7 . 123161 

6.953334 

5265.344999 


8.418725 

5.116)95 

3888.139999 


5 ■ 594966 

8.419679 

6242.443999 


8.957613 

3.7*49*7 

3129479999 


4.987133 

4.168868 

312282289# 


4.136481 

8 129922 

419.388499 


8.256929 

182.274286 

35719.349999 


196 672266 

184.665569 

33718.349999 


193.844486 

3 628531 

1734.398899 


2.969918 

2.358172 

1791.739999 


2.243926 

4.296958 

1226.849999 


16.773588 

3.937829 

1239.988999 


9.369446 

6.194576 

63.974939 


9.416678 

6.178293 

83.818539 


9.361661 

6.394484 

63.975976 


9.273278 

t .628331 

331.221268 


13.934746 

1.858745 

331.847688 


13.686646 

4 . 679388 

3385. 682896 


4.152667 

8.924697 

861.521588 


2.494996 

8.425836 

122.448488 


6. 153361 

6.212276 

67.734836 


6.385368 

6.186293 

67.139856 


8.373177 

6.151954 

84.721638 


6. 164692 

0.175358 

84.315588 


6.179599 

1 . 139884 

238.324468 


2.776696 

1 . 166466 

238.413768 


2.862386 

6.167962 

21.656876 


1.636252 

6.173848 

21.684618 


1.636756 

5.511643 

4945.992698 


5.814549 

12 687668 

7264.449989 


13.231346 


TIME - 16:99:28 


10 | 

parameter title 

24 ) 

MCC HG INJ PR a 

33 ) 

HPFP CLNT LNR A 

34 ) 

HPFP CLNT LNR 8 


SAFO SLICE TO SLICE SICW VAKIATION^STUOY (DM.IWLI [SL«»te] 

4 f E2919 • 194KPL) [SL499191 

CENST AT PROGRAM VERSION - 1-8Yb 

TOTAL ENGINES - 1 TOTAL RUNS - 

W/r CO* ✓<>££* 

MEAN 


SICUA SL 


7K PSU 
OPS PC 19K PSIS 

MCC OX INJ PR 5K PSIS 
HPFP 05 PR NFO 6599 PSI 
MCC PC A AVG (MCPA) 
MCC PC B AVG (UCPS) 
MCC CLNT OS Tl#* B 
HPFP SPEED A 
HPFP SPEED B 
HP FT OS W A 
HPFT OS TW B 
HPOT OS TIP A 
HPOT OS TIP* B 
FAC OX FM OS PR 359 PSIS 
ENG OX IN PR 1 259 PSIS 

ENG OX IN PR 2 259 PSIS 

LPOP OISCHG PR A 
LPOP OISCHG PR B 
HX INT PR 5*C PSIS 

HX IMT T 189/1999 

HX VENT OP 259PSI0 

OPOV ACT POS A (0PV2) 
OPOV ACT POS 8 (RVDO-1) 
FPOV ACT POS A (FPV2) 
FPOV ACT POS B (RVOR-2) 
LPFP OISCHG PR A 
LPFP OISCHG PR B (P18) 
ENG FL IN PR 1 189 PSI 

ENG FL IN PR 2 199 PSI 

HPOP OS PR NFO 7K PSIA 
POP os PR NFO *599 PSI 


3414.178999 
3483.888999 
3481 936999 
5216273999 
5259 555999 
3714.312999 
6187.762669 
3136.245966 
3122.966966 
444.831866 
35132.626666 
33127.346696 
1731 .536969 
1766.972999 
1387.977696 
1494 664666 
89.367436 
81.163169 
81.273569 
335.853999 
334 183389 
3897.715999 
•15.192168 
88.381698 
76.626338 
76.51437# 
82.185826 
81.687336 
236 483269 
238.594196 
7.846723 
7.584492 
4688 483898 
7123.242898 


7.597393 
5.939776 
6.378578 
7.613472 
6 . 891899 
5.484937 
11.264226 
4.575542 
4 647684 
1.683568 
384.316389 
557.677289 
6383997 
19.842199 
7.975738 
2354313 
8.425198 
9.372645 
6.575459 
1,637295 
1 .679846 
5.919732 
6.767595 
6.983282 
9.133596 
9.116327 
8. 163748 
8.168848 
2.647325 
2.622538 
4.21*816 
6.223712 
7.482929 
14. 2426*8 


TOTAL SLICES - 

366 

WITH LOX VEttl 

MEAN 

SIGMA 5L 

3359.759999 

7.616384 

3415.322998 

7.2*9684 

3421.918999 

8.128956 

5133.939999 

6.186688 

5184.922999 

6.574*75 

3717.699999 

5.4*1334 

6176.387999 

8- *27395 

3127.474999 

4. *49453 

3125.361999 

3 366368 

477.636399 

•557341 

35341.389999 

451-596668 

35327.319999 

458. 189884 

1646.938999 

5.386976 

1887.157999 

3.964813 

1317.987999 

4.393735 

1333.335999 

3.888835 

51.57793# 

1.884575 

51989479 

1.889279 

52.626149 

1.864987 

314.231999 

3.464459 

315.787899 

3.494998 

3712.877999 

3.885739 

785.388899 

1.457747 

76.484769 

8.973778 

88.919319 

6.165753 

658546 16 

6.138886 

61.488969 

6.156638 

81 . 433*99 

6.137637 

227.478799 

1.289998 

226.492899 

1 . 385388 

7.627837 

• 217651 

7.57*883 

6.222751 

487*. 622*88 

5.723232 

734*. *869*6 

11.357828 


ORIGINAL PAGE IS 

OF POOR QUALITY 




SAFD Simulation Of Hot-Fire Test 901-364 
Values For N2*<T 


Case I 
N2 * a 

SD pre-computed 
N2 - 1 


Cases 11,111 
N2 * a 

O' - SD computed on line 
N2 - 8 


1 Sec Injector Faceplate dP 

2 Prim Injector Faceplate dP 

3 Hot Gas Injector dP 

4 Coolant Liner dP 

5 HPFT dP 

6 HPOT dP 

7 MCC OX Inj P - MCC PC 

8 HPFP Ds P - MCC PC 

9 MCC PC 

10 MCC Coolant Ds T 

11 HPFP Speed 

12 HPFT Ds T1 A 

13 HPFT Ds T1 B 

14 HPOT Ds T1 

15 HPOT Ds T2 

16 Facility Ox Flowmeter Ds P 

17 Engine Ox Inlet P 

18 LPOP Ds P 

19 HEX Int P 

20 HEX Int T 

21 HEX Vent dP 

22 OPOV Act Position 

23 FPOV Act Position 


— 






24 . 53 

22.08 

29.46 

20.48 

20.0 

27.12 

46.5 

31.44 

31.6 

21.28 

38.97 

34.0 

21.2 

28.0 

6.3 

1.6 

184.2 

130.72 

38.78 

24.64 

30.56 

17.36 

18.39 

14.56 

32.3 

8.96 

5.88 

6.32 

4.75 

3.12 

20.94 

4.8 

27.95 

15.68 

10.08 

3.36 

1.83 

0.32 

0.759 

0.68 

1.2 

0.864 


Case I Simulation cutoff at 214.553 seconds 

Cases II, III Simulation cutoff at 206.75 and 205.75 seconds. 


respectively 


SD - Standard Deviation 

N2 - Multiplying factor for Approach- 2 
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THE END TIME FOR PLOTTING DATA IS 8.9800E+00 

THE START TIME FOR PLOTTING IS 3.5000E+00 

THE TIME INCREMENT IS 2.0000E-02 
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Table 6.2.3 

Signal Limit Composition, Test 750-285 


Parameter 

Signal Limit 
Average (AVG) 

Signal Limit 
Standard Deviation (SD) 

n 

OPOV Actuator 
Position 

68. 

0.2 


63. 

HPOTP Coolant 
Liner Pressure 

3614. 

5.0 


7.8 

HPOTP Intermediate 
Seal Purge Pressure 

275. 

0.6 


38.5 

HPOT Dis Temp A 

1435. 

1.94 


7.1 

HPOT Dis Temp B 

1464. 

1.5 

h* 

19.7 

LPOP Dis Pres 

355. 

0.83 


3.8 

Oxidizer Preburner 7944. 

Boost Pump Dis Pres 

16.79 


2.5 

FPOV Actuator 
Position 

83. 

1.0 

1 ° 

5.0 



Note: Signal limits, defined by AVG+ n*SD. 
in Figures 5A1,2 through 5H1,2 for 


are shown graphically 
selected parameters 


XV 
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n2 

*P 

c/o (seconds) 

26 

6 

279.67 

26 

7 

295.42 

26 

8 

none 

27 

7 

298.7 



redline cutoff: 405.5 




TABLE 6.2.5 

Simulation Results For Test 902-471 


nl 

*P 

c/o (seconds) 

2.5 

4 

146.24 

2.5 

5 

146.28 

2.5 

6 

146.28 

2.5 

7 

146.76 

2.5 

8 

146.76 

2.0 

6 

50.68 (premature) 

3.5 

6 

none 

redline cutoff: 147.68 


Where n 1 ,n2 - Multiplying factor which determines signal limits for Approaches- 1,2. 

*P - The number of parameters experiencing anomalies simultaneously 
required for algorithm to signal a shutdown. 

c/o - The algorithm shutdown (cutoff) time. 
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TABLE *.2.6 

COMPARISON OF RESULTS, Simulation for Test 901-340 


Simulation Run No. N2 No. Parameters Required SAFO 

For Shutdown Shutdown Time (Sec) 

22.04 
21 .0 
20.28 
19.8 
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FU PREBURN. OX VALVE ACT POS 


TABLE 6.4.1 


PARAMETER DESCRIPTION 


PERCENT CHANGE FROM NOMINAL 
1 lb-sec 5 lb-sec 
leak leak 


FUEL PREBURNER TEMP 
OX PREBURNER TEMP 
OX PREBURNER PRESSURE 
MAIN CHAMBER PRESSURE 
HPOP DISCHARGE PRESSURE 
HPFP DISCHARGE PRESSURE 
FPOV POSITION 
OPOV POSITION 
BOOST PUMP DIS PRESSURE 
MAIN CHAMBER MIX RATIO 


279 

-1.40 

743 

-2.16 

228 

-1.18 

192 

-0.99 

255 

-1.32 

188 

-0.97 

182 

0.70 

125 

1.20 

454 

-2.32 

265 

-0.76 
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FIGURE 1. Pressurization/Venting Effects on Parameters 

O/I 






SAFD Algorithm Schematic 
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Algorithm C/0: 214.79 sec 
Slope-Average Approach (Redline C/0: 392.15 sec) 

Figure 4P - Heat Exchanger Interface Temp, Test 901-364 
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Figure 6A1 High Pressure Oxidizer Turbine Delta-P, Measurement Signal 
Test 901-340 



Figure 6A2 High Pressure Oxidizer Turbine Delta-P, SAFD Algorithm Signal Average 
Test 901-340 
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Figure 6B2 High Pressure Fuel Turbine Delta-P, SAFD Algorithm Signal Average 
Test 901-340 
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Figure 6C2 
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Figure <JD1 HEX Vent Delta-P, Measurement Signal 
Test 901-340 




Figure 6D2 HEX Vent Delta-P, SAFD Algorithm Signal Average 
Test 901-340 
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Figure 6E1 HEX Interface Pressure, Measurement Signal 
Test 901-340 



Figure 6E2 HEX Interface Pressure, SAFD Algorithm Signal Average 
Test 901-340 
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Figure tfi High Pressure Fuel Pump Coolant Liner Delta-P, Measurement Signal 
Test 901-340 
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Figure ?A High Pressure Oxidizer Turbine Discharge Temp. A, Measurement Signal 
Test 902-471 
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Figure 7D High Pressure Fuel Pump Balance Cavity Pressure, Measurement Signal 
Test 902-471 
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Figure High Pressure Oxidizer Pump Discharge Pressure A, Measurement Signal 

Test 902-471 
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Figure 7F Main Combustion Chamber Pressure, Measurement Signal 
Test 902-471 
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Figure 7H High Pressure Fuel Pump C 
Test 902-471 


C i n n 3 1 




TIME FROM ENGINE START. SECS 


Figure 71 


HEX Interface Temperature, Signal Measurement 
Test 902-471 




PRESSURE - PS I 


I 


r 


tffP COOL ANT LtNER OELTA-P 


SBGOH 

AVIN5+ 

— - AV3CN 

AV304 

AVIHA+ 


TEST go 1-5+0 
TEST 901-5+0 
TEST 901-5+0 
TEST 901-5+0 
TEST 901-5+0 


l APPROACH- 1 
(APPROACH-1 
(APPROACH-1 
(APPROACH-1 
(APPBOAO+-1 


BEGINS AT 
BEGINS AT 
BEGINS AT 
BEGINS AT 

begins AT 


18-SEC FROM START) 
18-SEX FROM START) 
18-SEC FRB1 START) 
18-SEX FROM START) 
18-SEC FRB1 START) 


S7/05/Z2 3—i 

QSAFCOO 1 


500 


HOO 


300 


200 



15 . 0 20.0 

TIME-SECONDS 


Algorithm starti 12.08 sec. 


Redline 
Cutoff » 

40^,5 


ORIGINAL PAGE ^ 

OF POOR QUALITY 


FIGURE 8A 


- 113 - 


TEMPERATURE - DEG 


B7/05/S2 

QSAFDOO 


13 - 


r 


HOT 

- SEJ61H 

- AY1N1H 

- AV&UH 

- AV3<1H 

- AVIN1H 


OK TURBIN OS Wl 
TEST 901-3*0 (AFPROAO-H BEDIK6 AT 
TEST 901-3*0 (ARPR0AO4-I BEG INS AT 
TEST 901-3*0 IAffROAO+-l BEC £ 
TEST 901-3*0 CAFFROAOM B ES jg AT 
TEST 901-3*0 (AFPROAO+-I BEOIK6 AT 


12- SEC FHCM START) 
ia-5EC FROM START) 

13- SEC FROM START) 
12-SEC FROM START) 
12-SEC FRCH START) 






FIGURE 8B 


- 114 - 


TEMPERATURE - DEG 


* 



r 


Him PRESS) ff* OK TVJW)E OS itrP2 
=*15^ TEST 901-3+0 (APmDACH-l BECI« AT 

- MMK TEST 901-3+0 S{5| £ 

. AYSN15 TEST 901-3+0 APTOAO+- ECUS AT 

- AV3+15 TEST 901-3+0 UffW>D+*l BK1* AT 




12-SEC FTOI START) 
12-SEC FTOI START) 
12-SEC mOM START) 
12-SEC mOH START) 


rrrr am-'M) 


lAPP+wcr+*i aujiro — - _ 1 _ r , 

iiceeniru-i PFDIhfi AT 12-SEC FIOI START) 


07/05/22 W— l 

OSAFDOO 1 



FIGURE 8C 


- 115 - 


PRESSURE - PS! A 


87/05/22 

QSAFE00 


r 


KK JKT PR 

SE>619 

— AV1N19 

• AV3M9 

AVXI9 

AV1N19 


TEST 901-5*0 
TEST 901-5*0 
TEST 901-5*0 
TEST 901-5*0 
TEST 901-5*0 


(AFPROACH-1 BEE I *6 AT 12-SEC FROM START) 
(APPRQAO+-1 BEE 1*6 AT 12-SEC FROi START) 
(APPROACH-1 BEE I *6 AT 12-SEC FROM START) 
(APFR0AO4-1 BES1N5 AT 12-SEC FROM START) 
(AFFRQAQt-l BEGINS AT 12-SEC FROM START) 


18 n 



FIGURE 8D : 


- 116 - 


TEMPERATURE - DEG 


W IMT TOP 
- SOSO 
ayisd 


— — - Avaeo 

- AV360 
AVISO 


TEST 901-540 (AFPROACH-l BE01S AT I2-SC FROM START) 

1ST 901-340 (APFRWCH-l EEG1W3 AT 12-SEC f™5J! 

TT5T 0)1-340 (APPROACH-1 EEGlhE AT 12-SEC FROH START) 

TEST 901-340 (A fPRO ACH-l BEG1S AT lg-SC JWH START 

TEST 901-340 (APPROACH-1 BE01S AT 12-SEC FROI START 


07/05/22 19— j 

GSATDOO 1 



FIGURE 8E 


- 117 - 


PRESSURE - PS I 


W VENT CB-TArP 


SE>eai 

AVirei 



Avaei 

AVIN21 


TEST 901-y*0 
TEST 901-5*0 
TEST 901-5*0 
TEST 901-5*0 
TEST 901-5*0 


IAPPHDACH-1 BEGINS AT 12-SEC FROI START) 
SSSSotl »1« AT 1£9E FROM START) 
c APPROACH-1 BEGINS AT 12-SEC FRCH START) 
l APPROACH- 1 BEGINS AT 12-SEC FROM START) 
(AFPROAO+-1 BEGINS AT 12-SEC FROM START) 


67/05/22 

QSAFDOO 


20 - 



FIGURE 8F 


- 118 - 


PERCENT POSITION 


't 



r 


FPW ACT 

SJS23 

....... AVINE 

_ — - AV&S3 

- A V5C3 

AVINC3 


POSITION 

1ST 901-5*0 
TEST 901-5*0 
TEST 901-5*0 
TEST 901-5*0 
TEST 901-5*0 


(AFRROACH-l BEGINS AT 
(APPRQAO+-1 BEDIMS AT 
C APPROACH-1 BEGINS AT 
CAFPRQAO+-I BEGINS AT 
(AFPROACH-l BEGINS AT 


18-SEC FROM START) 
18-SEC FROM START) 
18-SEC FROM START! 
18-SEC FROM START 1 
18-SEC FROM START) 


87/05/22 ffi- 
QSAFDOO 




FIGURE 8G 


- 119 - 


PERCENT POSITION 


r 


(FW ACT 
SDSS 

Avues 

___• AV3€2 

AV3G2 

AVItffi 


POSITION 

TEST 901-5*0 
TEST 901-5*0 
TEST 901-5*0 
TEST 901-5*0 
TEST 901-5*0 


UPTOAW-I 

(AFPRQAD+-1 

(AFTOAO-t-1 

cafproach-i 

aafproach-i 


BEGINS AT 
BEGINS AT 
EEGINS AT 
BEGINS AT 
BEGINS AT 


Ig-SEC FROM START) 
12-SEC FROM START) 
12-SEC FROM START) 
12-SEC FROM START) 
iSuffP TOTH 51 APT) 


87/05/22 21 — 

GSAFCOO 



10.0 


15. 0 20.0 

TIME-SECONDS 


Algorithm start* 12.08 sec< 


Redline 
C/0» 405*5 


FIGURE 8H 


- 120 - 


PRESSURE - PS1 


HICK 


87/05/22 

QSVDOO 



r tssax FIB. TtfBINC 
SP S05 TET 901-540 

AV1NQ5 TEST 901-5+0 

AV2N05 TEST 901-5+0 

AV5C5 TEST 901-5+0 

AVIKC5 TEST 901-5+0 


cblta-p 

iaftwch-i 

lAFFTOACH-l 

lAmwoH 

CAPFTOAO+-1 

[XflWCW 


BEGINS AT 
BEGINS AT 
BEGINS AT 
BEGINS AT 
BESIKS AT 


12-SEC FHOI START! 
12-SEC FROM START) 
12-SEC FROM START) 
12-SEC FROM START) 
12-SEC FROM START) 


H n 





I 

1 — Algorithm start* 12.08 sec. 


Bedline 1 

C/Oi 40 5-5 sec 


xlJ 


FIGURE 81 


- 121 - 







PERCE 






TEMPERATURE - DEQ 


WFT TTJR DIS T A . . _ ,, AtA 

M4 ATTOTT1 ST<*T U CKT ACCmON 11/W SICRRV M - &KT7\ 

0 0 0 0 231 WFT1WD6 SSft CONTROLLER DATA FOR TEST *>1294 T^S* D* 


89/U>07 

CRTLOOK 


/ n . 


1.0X19 


3.9 

TIME - SECONDS 


FIGURE 9C - Test 901-284 


ORIGINAL PAGE IS 

OF POOR QUALITY 



TEMPERATU 















VISd 


poos atpoto start u oit «®rncN 11/B9 „ S *^ L fijr ^reitr data 

334 W>OP DS PR MF SSJC COHTROLLBl DATA FOR TEST 901284 Tc 


89/12W7 

CRTLOOK 



ME - SECONDS 


FIGURE 9J - Test 901-284 

ORIGINAL PAGE IS 

OF POOR QUALITY 





PRESSURE - PS1A 


WFP DXS PR .. 

P(3) ATTOTH START U OCT ADDITION 11/B9 SJSWHOO &-DA™ 

469 WFP DS PR W sac CONTROLLER DATA FOR TEST 9012S4 tcsr LX* 


SO 00.0 


aooo-o 


2000.0 



TIME - SECONDS 

ORIGINAL PAGE IS 
OF POOR QUALITY 

FIGURE 9K - Test 901-284 






SECONDS ou 


i ;u 


4.UU 




ORIGINAL PAGE IS 
OF POOR QUALITY 


FIGURE 10A - Test 902-428 










T PT 2DB OPB TOT TIC 
— T0T2 D2 FfCUX TEST 902-428 


HPOT Dis Temp CH B 


90/0l«4 

TONVOOO 



preceding page blank not filmed 

FIGURE IOC - Test90*‘ 428 


ORIGINAL PAGE IS 
OF POOR QUALITY 






90/OIP64 

TONVOOO 


r 


TO Tg llX WAT EX TBF 
- TUraOX FAILURE TEST 902-428 



OfitGIftfAE PAGE 1 $ ' 

0? quality 

FIGURE 10D - Test 902-428 -136- 








PRESSURE - PSIA 



38 - 


PRESSURE - PSIA 



39 - 




1FAKACT FLOW (LB/SFC) 



SShE CONTROLLER DATA FOR TEST 








Figure 11G* High Pressure Oxidizer Turbine .Discharge Temperature 
234 KPOT Tin OS T a (OTD0) 


207.5 


T6 ST DATA 


uSuMit 


T 




212.5 


TIME FROM ENGINE STFR7 ,S£C5 


222.5 


CHJJT ^.36-FD 

0T- I.M 


Figure 1 1D Oxidizer Preburner Oxidizer Valve Position 
48 OPOV ACT POSIT (GPV1) 


est data 




TIME FROM ENGINE STRRT ,SECS 

OPUJT dB.fi-n 

PT- C.M 


ORIGINAL PAGE IS 

-141- 

OF POOR QUALITY 















63 MCC PC RVG 


Figure (ME Main Combustion Chamber Pressure 


2i)-5 



TIME FROM ENGINE STRRT ,SECS 

{pjCT 

or* i.M 

6 MX RATIO 

Figure 11F Mixture Ratio 
(MXRT) 



■tell 


II 


20^.5 - 21^.5 ' ' _ 2l).5 ' 222.5 


TIME FROM ENGINE STRRT .SECS 

OUT dl.H-n 
0I» I.M 

ORIGINAL PAGE IS 

-142- 

OF POOR QUALITY 
















- 143 - 


oriqisval page is 

OF POOR QUALITY 


TEHPCRA1URE - DEO R 
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FIGURE 121 - Hypothetical Leakage Effect 
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Figure 12K - Hypothetical Leakage Effect 
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Figure 121 - Hypothetical Leakage Effect 
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Figures Showing the Effects of a 5 lb/sec Lox 
Leak Downstream of the Preburner Pump 
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Figure '1 2M - Hypothetical Leakage Effect 
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Figure 12N - Hypothetical Leakage Effect 
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Figure 12Q - Hypothetical Leakage Effect 
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Figure 1.2R - Hypothetical Leakage Effect 
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Figure 12S - Hypothetical Leakage Effect 
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Figure 1-2T - Hypothetical Leakage Effect 
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Figure 1-3P - Hypothetical Blockage Effect 
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Figure 13Q - Hypothetical Blockage Effect 
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Figure 14B - Closed-Loop Simulation 
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Figure 14C - Closed-Loop Simulation 
of Leakage: Approach 1 


csr»oi 




temperature 


HCH PRESSURE FUEL TIRHNE (FP FT) OS TDP1 
IPm!? cour'/fiS 2 M *j”! -W P 5? m -' Noz. Ruplur* Foilor« (5 lb ox |#ok) 

SS I |&f® |m.. Noz. Ruptoro FoilSro 5 b ox 1,2k 

3 * Sjm., Noz. Rupluro Foiluro 5 lb ox look 

SSME/SAFD CJoiod-Loop Sim., Nor, Ruptur# Foil or# (5 lb ox look 


!■■■■ 


■b: 


(■■■■■■■■■'I 

■■■■■■■■■HI 




iiii 


III! 


!■■■■■!!■■■■■■■■■■ 


as— 


nnm.ii.iKia 


TEMPERATURE - OEG. 


HCH PRESSIRE OX URBWE OS TEMP’ 



Figure 14E - Closed-Loop Simulation 
of Leakage: Approach 1 
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Figure 1 4G - Closed-Loop Simulation 
of Leakage: Approach 1 
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Figure 14H - Closed-Loop Simulation 
of Leakage: Approach 1 
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Figure 15A - Closed-Loop Simulation 
of blockage Approach 2 
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Figure 198 - Closed-Loop Simulation 
of blockage Approach 2 
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Figure 15C - Closed-Loop Simulation 
of blockage Approach 2 
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Figure 15D - Closed-Loop Simulation 
of blockage Approach 2 
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Figure 1 5E - Closed-Loop Simulation 
of blockage Approach 2 
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Figure 15F - Closed-Loop Simulation 
of blockage Approach 2 
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Figure J 1 5G - Closed-Loop Simulation 
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Figure 15H - Closed-Loop Simulation 
of blockage Approach 2 
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Figure 151 - Closed-Loop Simulation 
of blockage Approach 2 
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FIGURE 16 Effects of GOX & Fuel 
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Sensor Failure Detection & Identification 
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Test 901-436 Simultaneous 
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